Adding kernel offset validation

src/effects/SkMatrixConvolutionImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkMatrixConvolutionImageFilter.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ skipping 68 matching lines @@
     }
     fGain = buffer.readScalar();
     fBias = buffer.readScalar();
     fKernelOffset.fX = buffer.readInt();
     fKernelOffset.fY = buffer.readInt();
     fTileMode = (TileMode) buffer.readInt();
     fConvolveAlpha = buffer.readBool();
     buffer.validate((fKernel != 0) &&
                     SkScalarIsFinite(fGain) &&
                     SkScalarIsFinite(fBias) &&
-                    tile_mode_is_valid(fTileMode));
+                    tile_mode_is_valid(fTileMode) &&
+                    (fKernelOffset.fX >= 0) && (fKernelOffset.fX < fKernelSize.fWidth) &&
+                    (fKernelOffset.fY >= 0) && (fKernelOffset.fY < fKernelSize.fHeight));
 }
 
 void SkMatrixConvolutionImageFilter::flatten(SkWriteBuffer& buffer) const {
     this->INHERITED::flatten(buffer);
     buffer.writeInt(fKernelSize.fWidth);
     buffer.writeInt(fKernelSize.fHeight);
     buffer.writeScalarArray(fKernel, fKernelSize.fWidth * fKernelSize.fHeight);
     buffer.writeScalar(fGain);
     buffer.writeScalar(fBias);
     buffer.writeInt(fKernelOffset.fX);
@@ skipping 577 matching lines @@
                                                 fBias,
                                                 fKernelOffset,
                                                 fTileMode,
                                                 fConvolveAlpha);
     return true;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 #endif