Adding validation before using an SkImageInfo object read from an SkReadBuffer.

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1183 matching lines @@
 
 bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) {
     const size_t snugRB = buffer->readUInt();
     if (0 == snugRB) {  // no pixels
         return false;
     }
 
     SkImageInfo info;
     info.unflatten(*buffer);
 
+    // If there was an error reading "info", don't use it to compute minRowBytes()
+    if (!buffer->validate(true)) {
+        return false;
+    }
+
     const size_t ramRB = info.minRowBytes();
     const int height = info.height();
     const size_t snugSize = snugRB * height;
     const size_t ramSize = ramRB * height;
     if (!buffer->validate(snugSize <= ramSize)) {
         return false;
     }
 
     char* dst = (char*)sk_malloc_throw(ramSize);
     buffer->readByteArray(dst, snugSize);
@@ skipping 164 matching lines @@
 ///////////////////////////////////////////////////////////////////////////////
 
 #ifdef SK_DEBUG
 void SkImageInfo::validate() const {
     SkASSERT(fWidth >= 0);
     SkASSERT(fHeight >= 0);
     SkASSERT(SkColorTypeIsValid(fColorType));
     SkASSERT(SkAlphaTypeIsValid(fAlphaType));
 }
 #endif