Index: src/core/SkBitmap.cpp |
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp |
index d3bbecd7066dfe4d826d5bd778e635c1e5215910..318ccc3ea0a7890b28f1f1507e08864b27097505 100644 |
--- a/src/core/SkBitmap.cpp |
+++ b/src/core/SkBitmap.cpp |
@@ -19,6 +19,7 @@ |
#include "SkThread.h" |
#include "SkUnPreMultiply.h" |
#include "SkUtils.h" |
+#include "SkValidation.h" |
#include "SkPackBits.h" |
#include <new> |
@@ -1607,9 +1608,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
int width = buffer.readInt(); |
int height = buffer.readInt(); |
int rowBytes = buffer.readInt(); |
- int config = buffer.readInt(); |
+ Config config = (Config)buffer.readInt(); |
+ buffer.validateData((width >= 0) && (height >= 0) && (rowBytes >= 0) && |
+ IsValidConfig(config)); |
- this->setConfig((Config)config, width, height, rowBytes); |
+ this->setConfig(config, width, height, rowBytes); |
this->setIsOpaque(buffer.readBool()); |
int reftype = buffer.readInt(); |
@@ -1623,6 +1626,7 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
case SERIALIZE_PIXELTYPE_NONE: |
break; |
default: |
+ buffer.validateData(false); |
SkDEBUGFAIL("unrecognized pixeltype in serialized data"); |
sk_throw(); |
} |