| Index: src/core/SkBitmap.cpp
|
| diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
|
| index d3bbecd7066dfe4d826d5bd778e635c1e5215910..2fdfb9bd3cd5f9657a746967e9b18c94c72317e3 100644
|
| --- a/src/core/SkBitmap.cpp
|
| +++ b/src/core/SkBitmap.cpp
|
| @@ -19,6 +19,7 @@
|
| #include "SkThread.h"
|
| #include "SkUnPreMultiply.h"
|
| #include "SkUtils.h"
|
| +#include "SkValidationUtils.h"
|
| #include "SkPackBits.h"
|
| #include <new>
|
|
|
| @@ -1607,9 +1608,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
|
| int width = buffer.readInt();
|
| int height = buffer.readInt();
|
| int rowBytes = buffer.readInt();
|
| - int config = buffer.readInt();
|
| + Config config = (Config)buffer.readInt();
|
| + buffer.validateData((width >= 0) && (height >= 0) && (rowBytes >= 0) &&
|
| + SkIsValidConfig(config));
|
|
|
| - this->setConfig((Config)config, width, height, rowBytes);
|
| + this->setConfig(config, width, height, rowBytes);
|
| this->setIsOpaque(buffer.readBool());
|
|
|
| int reftype = buffer.readInt();
|
| @@ -1623,6 +1626,7 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
|
| case SERIALIZE_PIXELTYPE_NONE:
|
| break;
|
| default:
|
| + buffer.validateData(false);
|
| SkDEBUGFAIL("unrecognized pixeltype in serialized data");
|
| sk_throw();
|
| }
|
|
|