Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(698)

Side by Side Diff: src/core/SkBitmap.cpp

Issue 306033003: Fixing a clusterfuzz found issue (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Created 6 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 1
2 /* 2 /*
3 * Copyright 2008 The Android Open Source Project 3 * Copyright 2008 The Android Open Source Project
4 * 4 *
5 * Use of this source code is governed by a BSD-style license that can be 5 * Use of this source code is governed by a BSD-style license that can be
6 * found in the LICENSE file. 6 * found in the LICENSE file.
7 */ 7 */
8 8
9 9
10 #include "SkBitmap.h" 10 #include "SkBitmap.h"
(...skipping 1290 matching lines...) Expand 10 before | Expand all | Expand 10 after
1301 return false; 1301 return false;
1302 } 1302 }
1303 1303
1304 SkImageInfo info; 1304 SkImageInfo info;
1305 info.unflatten(*buffer); 1305 info.unflatten(*buffer);
1306 1306
1307 const size_t ramRB = info.minRowBytes(); 1307 const size_t ramRB = info.minRowBytes();
1308 const int height = info.height(); 1308 const int height = info.height();
1309 const size_t snugSize = snugRB * height; 1309 const size_t snugSize = snugRB * height;
1310 const size_t ramSize = ramRB * height; 1310 const size_t ramSize = ramRB * height;
1311 SkASSERT(snugSize <= ramSize); 1311 if (!buffer->validate(snugSize <= ramSize)) {
1312 return false;
1313 }
1312 1314
1313 char* dst = (char*)sk_malloc_throw(ramSize); 1315 char* dst = (char*)sk_malloc_throw(ramSize);
1314 buffer->readByteArray(dst, snugSize); 1316 buffer->readByteArray(dst, snugSize);
1315 SkAutoDataUnref data(SkData::NewFromMalloc(dst, ramSize)); 1317 SkAutoDataUnref data(SkData::NewFromMalloc(dst, ramSize));
1316 1318
1317 if (snugSize != ramSize) { 1319 if (snugSize != ramSize) {
1318 const char* srcRow = dst + snugRB * (height - 1); 1320 const char* srcRow = dst + snugRB * (height - 1);
1319 char* dstRow = dst + ramRB * (height - 1); 1321 char* dstRow = dst + ramRB * (height - 1);
1320 for (int y = height - 1; y >= 1; --y) { 1322 for (int y = height - 1; y >= 1; --y) {
1321 memmove(dstRow, srcRow, snugRB); 1323 memmove(dstRow, srcRow, snugRB);
(...skipping 153 matching lines...) Expand 10 before | Expand all | Expand 10 after
1475 /////////////////////////////////////////////////////////////////////////////// 1477 ///////////////////////////////////////////////////////////////////////////////
1476 1478
1477 #ifdef SK_DEBUG 1479 #ifdef SK_DEBUG
1478 void SkImageInfo::validate() const { 1480 void SkImageInfo::validate() const {
1479 SkASSERT(fWidth >= 0); 1481 SkASSERT(fWidth >= 0);
1480 SkASSERT(fHeight >= 0); 1482 SkASSERT(fHeight >= 0);
1481 SkASSERT(SkColorTypeIsValid(fColorType)); 1483 SkASSERT(SkColorTypeIsValid(fColorType));
1482 SkASSERT(SkAlphaTypeIsValid(fAlphaType)); 1484 SkASSERT(SkAlphaTypeIsValid(fAlphaType));
1483 } 1485 }
1484 #endif 1486 #endif
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698