Initial error handling code

src/core/SkBitmap.cpp

Index: src/core/SkBitmap.cpp
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index d3bbecd7066dfe4d826d5bd778e635c1e5215910..4cc042d2b2c57de48f653b6e07501f052639ff4b 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -266,6 +266,22 @@ void SkBitmap::getBounds(SkIRect* bounds) const {
 
 ///////////////////////////////////////////////////////////////////////////////
 
+bool SkBitmap::IsValidConfig(Config config) {

[reed1, 2013/09/03 20:25:21]

I'm not 100% sure that the compile will always execute this. Is there ever a
chance that an optimizing one will decide that the list is complete, and turn
the entire function into

return true;

[sugoi1, 2013/09/04 18:01:10]

Not sure, but I've changed it just to be certain.

+    switch (config) {
+    case kNo_Config:
+    case kA1_Config:
+    case kA8_Config:
+    case kIndex8_Config:
+    case kRGB_565_Config:
+    case kARGB_4444_Config:
+    case kARGB_8888_Config:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
 void SkBitmap::setConfig(Config c, int width, int height, size_t rowBytes) {
     this->freePixels();
 
@@ -1607,9 +1623,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
     int width = buffer.readInt();
     int height = buffer.readInt();
     int rowBytes = buffer.readInt();
-    int config = buffer.readInt();
+    Config config = (Config)buffer.readInt();
+    buffer.validateData((width >= 0) && (height >= 0) && (rowBytes >= 0) &&
+                        IsValidConfig(config));
 
-    this->setConfig((Config)config, width, height, rowBytes);
+    this->setConfig(config, width, height, rowBytes);
     this->setIsOpaque(buffer.readBool());
 
     int reftype = buffer.readInt();
@@ -1623,6 +1641,7 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
         case SERIALIZE_PIXELTYPE_NONE:
             break;
         default:
+            buffer.validateData(false);
             SkDEBUGFAIL("unrecognized pixeltype in serialized data");
             sk_throw();
     }