| Index: src/effects/SkMergeImageFilter.cpp
|
| diff --git a/src/effects/SkMergeImageFilter.cpp b/src/effects/SkMergeImageFilter.cpp
|
| index 0c47c91aff21d73e4da6738682da3d2f7d044657..a3a9f0909746280dbc5c0e596412d2d2c058b33d 100755
|
| --- a/src/effects/SkMergeImageFilter.cpp
|
| +++ b/src/effects/SkMergeImageFilter.cpp
|
| @@ -9,6 +9,7 @@
|
| #include "SkCanvas.h"
|
| #include "SkDevice.h"
|
| #include "SkFlattenableBuffers.h"
|
| +#include "SkValidation.h"
|
|
|
| ///////////////////////////////////////////////////////////////////////////////
|
|
|
| @@ -157,8 +158,12 @@ SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer) : INHERI
|
| bool hasModes = buffer.readBool();
|
| if (hasModes) {
|
| this->initAllocModes();
|
| - SkASSERT(buffer.getArrayCount() == countInputs() * sizeof(fModes[0]));
|
| + int nbInputs = countInputs();
|
| + SkASSERT(buffer.getArrayCount() == nbInputs * sizeof(fModes[0]));
|
| buffer.readByteArray(fModes);
|
| + for (int i = 0; i < nbInputs; ++i) {
|
| + buffer.validateData(IsValidMode((SkXfermode::Mode)fModes[i]));
|
| + }
|
| } else {
|
| fModes = 0;
|
| }
|
|
|