OLD | NEW |
1 /* | 1 /* |
2 * Copyright 2013 Google Inc. | 2 * Copyright 2013 Google Inc. |
3 * | 3 * |
4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
6 */ | 6 */ |
7 | 7 |
8 #include "SkBitmap.h" | 8 #include "SkBitmap.h" |
9 #include "SkErrorInternals.h" | 9 #include "SkErrorInternals.h" |
10 #include "SkValidatingReadBuffer.h" | 10 #include "SkValidatingReadBuffer.h" |
11 #include "SkStream.h" | 11 #include "SkStream.h" |
12 #include "SkTypeface.h" | 12 #include "SkTypeface.h" |
13 | 13 |
14 SkValidatingReadBuffer::SkValidatingReadBuffer(const void* data, size_t size) : | 14 SkValidatingReadBuffer::SkValidatingReadBuffer(const void* data, size_t size) : |
15 fError(false) { | 15 fError(false) { |
16 this->setMemory(data, size); | 16 this->setMemory(data, size); |
17 this->setFlags(SkFlattenableReadBuffer::kValidation_Flag); | 17 this->setFlags(SkFlattenableReadBuffer::kValidation_Flag); |
18 } | 18 } |
19 | 19 |
20 SkValidatingReadBuffer::~SkValidatingReadBuffer() { | 20 SkValidatingReadBuffer::~SkValidatingReadBuffer() { |
21 } | 21 } |
22 | 22 |
| 23 void SkValidatingReadBuffer::validate(bool isValid) { |
| 24 if (!fError && !isValid) { |
| 25 // When an error is found, send the read cursor to the end of the stream |
| 26 fReader.skip(fReader.available()); |
| 27 fError = true; |
| 28 } |
| 29 } |
| 30 |
23 void SkValidatingReadBuffer::setMemory(const void* data, size_t size) { | 31 void SkValidatingReadBuffer::setMemory(const void* data, size_t size) { |
24 fError = fError || !IsPtrAlign4(data) || (SkAlign4(size) != size); | 32 this->validate(IsPtrAlign4(data) && (SkAlign4(size) == size)); |
25 if (!fError) { | 33 if (!fError) { |
26 fReader.setMemory(data, size); | 34 fReader.setMemory(data, size); |
27 } | 35 } |
28 } | 36 } |
29 | 37 |
30 const void* SkValidatingReadBuffer::skip(size_t size) { | 38 const void* SkValidatingReadBuffer::skip(size_t size) { |
31 size_t inc = SkAlign4(size); | 39 size_t inc = SkAlign4(size); |
32 const void* addr = fReader.peek(); | 40 const void* addr = fReader.peek(); |
33 fError = fError || !IsPtrAlign4(addr) || !fReader.isAvailable(inc); | 41 this->validate(IsPtrAlign4(addr) && fReader.isAvailable(inc)); |
34 if (!fError) { | 42 if (!fError) { |
35 fReader.skip(size); | 43 fReader.skip(size); |
36 } | 44 } |
37 return addr; | 45 return addr; |
38 } | 46 } |
39 | 47 |
40 // All the methods in this file funnel down into either readInt(), readScalar()
or skip(), | 48 // All the methods in this file funnel down into either readInt(), readScalar()
or skip(), |
41 // followed by a memcpy. So we've got all our validation in readInt(), readScala
r() and skip(); | 49 // followed by a memcpy. So we've got all our validation in readInt(), readScala
r() and skip(); |
42 // if they fail they'll return a zero value or skip nothing, respectively, and s
et fError to | 50 // if they fail they'll return a zero value or skip nothing, respectively, and s
et fError to |
43 // true, which the caller should check to see if an error occurred during the re
ad operation. | 51 // true, which the caller should check to see if an error occurred during the re
ad operation. |
44 | 52 |
45 bool SkValidatingReadBuffer::readBool() { | 53 bool SkValidatingReadBuffer::readBool() { |
46 uint32_t value = this->readInt(); | 54 uint32_t value = this->readInt(); |
47 // Boolean value should be either 0 or 1 | 55 // Boolean value should be either 0 or 1 |
48 if (value & ~1) { | 56 this->validate(!(value & ~1)); |
49 fError = true; | |
50 } | |
51 return value != 0; | 57 return value != 0; |
52 } | 58 } |
53 | 59 |
54 SkColor SkValidatingReadBuffer::readColor() { | 60 SkColor SkValidatingReadBuffer::readColor() { |
55 return this->readInt(); | 61 return this->readInt(); |
56 } | 62 } |
57 | 63 |
58 SkFixed SkValidatingReadBuffer::readFixed() { | 64 SkFixed SkValidatingReadBuffer::readFixed() { |
59 return this->readInt(); | 65 return this->readInt(); |
60 } | 66 } |
61 | 67 |
62 int32_t SkValidatingReadBuffer::readInt() { | 68 int32_t SkValidatingReadBuffer::readInt() { |
63 const size_t inc = sizeof(int32_t); | 69 const size_t inc = sizeof(int32_t); |
64 fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc)
; | 70 this->validate(IsPtrAlign4(fReader.peek()) && fReader.isAvailable(inc)); |
65 return fError ? 0 : fReader.readInt(); | 71 return fError ? 0 : fReader.readInt(); |
66 } | 72 } |
67 | 73 |
68 SkScalar SkValidatingReadBuffer::readScalar() { | 74 SkScalar SkValidatingReadBuffer::readScalar() { |
69 const size_t inc = sizeof(SkScalar); | 75 const size_t inc = sizeof(SkScalar); |
70 fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc)
; | 76 this->validate(IsPtrAlign4(fReader.peek()) && fReader.isAvailable(inc)); |
71 return fError ? 0 : fReader.readScalar(); | 77 return fError ? 0 : fReader.readScalar(); |
72 } | 78 } |
73 | 79 |
74 uint32_t SkValidatingReadBuffer::readUInt() { | 80 uint32_t SkValidatingReadBuffer::readUInt() { |
75 return this->readInt(); | 81 return this->readInt(); |
76 } | 82 } |
77 | 83 |
78 int32_t SkValidatingReadBuffer::read32() { | 84 int32_t SkValidatingReadBuffer::read32() { |
79 return this->readInt(); | 85 return this->readInt(); |
80 } | 86 } |
81 | 87 |
82 void SkValidatingReadBuffer::readString(SkString* string) { | 88 void SkValidatingReadBuffer::readString(SkString* string) { |
83 const size_t len = this->readInt(); | 89 const size_t len = this->readInt(); |
84 const void* ptr = fReader.peek(); | 90 const void* ptr = fReader.peek(); |
85 const char* cptr = (const char*)ptr; | 91 const char* cptr = (const char*)ptr; |
86 | 92 |
87 // skip over the string + '\0' and then pad to a multiple of 4 | 93 // skip over the string + '\0' and then pad to a multiple of 4 |
88 const size_t alignedSize = SkAlign4(len + 1); | 94 const size_t alignedSize = SkAlign4(len + 1); |
89 this->skip(alignedSize); | 95 this->skip(alignedSize); |
90 fError = fError || (cptr[len] != '\0'); | 96 this->validate(cptr[len] == '\0'); |
91 if (!fError) { | 97 if (!fError) { |
92 string->set(cptr, len); | 98 string->set(cptr, len); |
93 } | 99 } |
94 } | 100 } |
95 | 101 |
96 void* SkValidatingReadBuffer::readEncodedString(size_t* length, SkPaint::TextEnc
oding encoding) { | 102 void* SkValidatingReadBuffer::readEncodedString(size_t* length, SkPaint::TextEnc
oding encoding) { |
97 const int32_t encodingType = fReader.readInt(); | 103 const int32_t encodingType = fReader.readInt(); |
98 fError = fError || (encodingType != encoding); | 104 this->validate(encodingType == encoding); |
99 *length = this->readInt(); | 105 *length = this->readInt(); |
100 const void* ptr = this->skip(SkAlign4(*length)); | 106 const void* ptr = this->skip(SkAlign4(*length)); |
101 void* data = NULL; | 107 void* data = NULL; |
102 if (!fError) { | 108 if (!fError) { |
103 data = sk_malloc_throw(*length); | 109 data = sk_malloc_throw(*length); |
104 memcpy(data, ptr, *length); | 110 memcpy(data, ptr, *length); |
105 } | 111 } |
106 return data; | 112 return data; |
107 } | 113 } |
108 | 114 |
109 void SkValidatingReadBuffer::readPoint(SkPoint* point) { | 115 void SkValidatingReadBuffer::readPoint(SkPoint* point) { |
110 point->fX = fReader.readScalar(); | 116 point->fX = fReader.readScalar(); |
111 point->fY = fReader.readScalar(); | 117 point->fY = fReader.readScalar(); |
112 } | 118 } |
113 | 119 |
114 void SkValidatingReadBuffer::readMatrix(SkMatrix* matrix) { | 120 void SkValidatingReadBuffer::readMatrix(SkMatrix* matrix) { |
115 const size_t size = matrix->readFromMemory(fReader.peek()); | 121 const size_t size = matrix->readFromMemory(fReader.peek()); |
116 fError = fError || (SkAlign4(size) != size); | 122 this->validate(SkAlign4(size) == size); |
117 if (!fError) { | 123 if (!fError) { |
118 (void)this->skip(size); | 124 (void)this->skip(size); |
119 } | 125 } |
120 } | 126 } |
121 | 127 |
122 void SkValidatingReadBuffer::readIRect(SkIRect* rect) { | 128 void SkValidatingReadBuffer::readIRect(SkIRect* rect) { |
123 const void* ptr = this->skip(sizeof(SkIRect)); | 129 const void* ptr = this->skip(sizeof(SkIRect)); |
124 if (!fError) { | 130 if (!fError) { |
125 memcpy(rect, ptr, sizeof(SkIRect)); | 131 memcpy(rect, ptr, sizeof(SkIRect)); |
126 } | 132 } |
127 } | 133 } |
128 | 134 |
129 void SkValidatingReadBuffer::readRect(SkRect* rect) { | 135 void SkValidatingReadBuffer::readRect(SkRect* rect) { |
130 const void* ptr = this->skip(sizeof(SkRect)); | 136 const void* ptr = this->skip(sizeof(SkRect)); |
131 if (!fError) { | 137 if (!fError) { |
132 memcpy(rect, ptr, sizeof(SkRect)); | 138 memcpy(rect, ptr, sizeof(SkRect)); |
133 } | 139 } |
134 } | 140 } |
135 | 141 |
136 void SkValidatingReadBuffer::readRegion(SkRegion* region) { | 142 void SkValidatingReadBuffer::readRegion(SkRegion* region) { |
137 const size_t size = region->readFromMemory(fReader.peek()); | 143 const size_t size = region->readFromMemory(fReader.peek()); |
138 fError = fError || (SkAlign4(size) != size); | 144 this->validate(SkAlign4(size) == size); |
139 if (!fError) { | 145 if (!fError) { |
140 (void)this->skip(size); | 146 (void)this->skip(size); |
141 } | 147 } |
142 } | 148 } |
143 | 149 |
144 void SkValidatingReadBuffer::readPath(SkPath* path) { | 150 void SkValidatingReadBuffer::readPath(SkPath* path) { |
145 const size_t size = path->readFromMemory(fReader.peek()); | 151 const size_t size = path->readFromMemory(fReader.peek()); |
146 fError = fError || (SkAlign4(size) != size); | 152 this->validate(SkAlign4(size) == size); |
147 if (!fError) { | 153 if (!fError) { |
148 (void)this->skip(size); | 154 (void)this->skip(size); |
149 } | 155 } |
150 } | 156 } |
151 | 157 |
152 uint32_t SkValidatingReadBuffer::readByteArray(void* value) { | 158 bool SkValidatingReadBuffer::readArray(void* value, size_t size, size_t elementS
ize) { |
153 const uint32_t length = this->readUInt(); | 159 const uint32_t count = this->getArrayCount(); |
154 const void* ptr = this->skip(SkAlign4(length)); | 160 this->validate(size == count); |
| 161 (void)this->skip(sizeof(uint32_t)); // Skip array count |
| 162 const size_t byteLength = count * elementSize; |
| 163 const void* ptr = this->skip(SkAlign4(byteLength)); |
155 if (!fError) { | 164 if (!fError) { |
156 memcpy(value, ptr, length); | 165 memcpy(value, ptr, byteLength); |
157 return length; | 166 return true; |
158 } | 167 } |
159 return 0; | 168 return false; |
160 } | 169 } |
161 | 170 |
162 uint32_t SkValidatingReadBuffer::readColorArray(SkColor* colors) { | 171 bool SkValidatingReadBuffer::readByteArray(void* value, size_t size) { |
163 const uint32_t count = this->readUInt(); | 172 return readArray(static_cast<unsigned char*>(value), size, sizeof(unsigned c
har)); |
164 const uint32_t byteLength = count * sizeof(SkColor); | |
165 const void* ptr = this->skip(SkAlign4(byteLength)); | |
166 if (!fError) { | |
167 memcpy(colors, ptr, byteLength); | |
168 return count; | |
169 } | |
170 return 0; | |
171 } | 173 } |
172 | 174 |
173 uint32_t SkValidatingReadBuffer::readIntArray(int32_t* values) { | 175 bool SkValidatingReadBuffer::readColorArray(SkColor* colors, size_t size) { |
174 const uint32_t count = this->readUInt(); | 176 return readArray(colors, size, sizeof(SkColor)); |
175 const uint32_t byteLength = count * sizeof(int32_t); | |
176 const void* ptr = this->skip(SkAlign4(byteLength)); | |
177 if (!fError) { | |
178 memcpy(values, ptr, byteLength); | |
179 return count; | |
180 } | |
181 return 0; | |
182 } | 177 } |
183 | 178 |
184 uint32_t SkValidatingReadBuffer::readPointArray(SkPoint* points) { | 179 bool SkValidatingReadBuffer::readIntArray(int32_t* values, size_t size) { |
185 const uint32_t count = this->readUInt(); | 180 return readArray(values, size, sizeof(int32_t)); |
186 const uint32_t byteLength = count * sizeof(SkPoint); | |
187 const void* ptr = this->skip(SkAlign4(byteLength)); | |
188 if (!fError) { | |
189 memcpy(points, ptr, byteLength); | |
190 return count; | |
191 } | |
192 return 0; | |
193 } | 181 } |
194 | 182 |
195 uint32_t SkValidatingReadBuffer::readScalarArray(SkScalar* values) { | 183 bool SkValidatingReadBuffer::readPointArray(SkPoint* points, size_t size) { |
196 const uint32_t count = this->readUInt(); | 184 return readArray(points, size, sizeof(SkPoint)); |
197 const uint32_t byteLength = count * sizeof(SkScalar); | 185 } |
198 const void* ptr = this->skip(SkAlign4(byteLength)); | 186 |
199 if (!fError) { | 187 bool SkValidatingReadBuffer::readScalarArray(SkScalar* values, size_t size) { |
200 memcpy(values, ptr, byteLength); | 188 return readArray(values, size, sizeof(SkScalar)); |
201 return count; | |
202 } | |
203 return 0; | |
204 } | 189 } |
205 | 190 |
206 uint32_t SkValidatingReadBuffer::getArrayCount() { | 191 uint32_t SkValidatingReadBuffer::getArrayCount() { |
207 return *(uint32_t*)fReader.peek(); | 192 return *(uint32_t*)fReader.peek(); |
208 } | 193 } |
209 | 194 |
210 void SkValidatingReadBuffer::readBitmap(SkBitmap* bitmap) { | 195 void SkValidatingReadBuffer::readBitmap(SkBitmap* bitmap) { |
211 const int width = this->readInt(); | 196 const int width = this->readInt(); |
212 const int height = this->readInt(); | 197 const int height = this->readInt(); |
213 const size_t length = this->readUInt(); | 198 const size_t length = this->readUInt(); |
214 // A size of zero means the SkBitmap was simply flattened. | 199 // A size of zero means the SkBitmap was simply flattened. |
215 fError = fError || (length != 0); | 200 this->validate(length == 0); |
216 if (fError) { | 201 if (fError) { |
217 return; | 202 return; |
218 } | 203 } |
219 bitmap->unflatten(*this); | 204 bitmap->unflatten(*this); |
220 fError = fError || (bitmap->width() != width) || (bitmap->height() != height
); | 205 this->validate((bitmap->width() == width) && (bitmap->height() == height)); |
| 206 } |
| 207 |
| 208 SkTypeface* SkValidatingReadBuffer::readTypeface() { |
| 209 // TODO: Implement this (securely) when needed |
| 210 return NULL; |
221 } | 211 } |
222 | 212 |
223 SkFlattenable* SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type type)
{ | 213 SkFlattenable* SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type type)
{ |
224 SkString name; | 214 SkString name; |
225 this->readString(&name); | 215 this->readString(&name); |
226 if (fError) { | 216 if (fError) { |
227 return NULL; | 217 return NULL; |
228 } | 218 } |
229 | 219 |
230 // Is this the type we wanted ? | 220 // Is this the type we wanted ? |
(...skipping 10 matching lines...) Expand all Loading... |
241 | 231 |
242 // if we get here, factory may still be null, but if that is the case, the | 232 // if we get here, factory may still be null, but if that is the case, the |
243 // failure was ours, not the writer. | 233 // failure was ours, not the writer. |
244 SkFlattenable* obj = NULL; | 234 SkFlattenable* obj = NULL; |
245 uint32_t sizeRecorded = this->readUInt(); | 235 uint32_t sizeRecorded = this->readUInt(); |
246 if (factory) { | 236 if (factory) { |
247 uint32_t offset = fReader.offset(); | 237 uint32_t offset = fReader.offset(); |
248 obj = (*factory)(*this); | 238 obj = (*factory)(*this); |
249 // check that we read the amount we expected | 239 // check that we read the amount we expected |
250 uint32_t sizeRead = fReader.offset() - offset; | 240 uint32_t sizeRead = fReader.offset() - offset; |
251 fError = fError || (sizeRecorded != sizeRead); | 241 this->validate(sizeRecorded == sizeRead); |
252 if (fError) { | 242 if (fError) { |
253 // we could try to fix up the offset... | 243 // we could try to fix up the offset... |
254 delete obj; | 244 delete obj; |
255 obj = NULL; | 245 obj = NULL; |
256 } | 246 } |
257 } else { | 247 } else { |
258 // we must skip the remaining data | 248 // we must skip the remaining data |
259 this->skip(sizeRecorded); | 249 this->skip(sizeRecorded); |
260 SkASSERT(false); | 250 SkASSERT(false); |
261 } | 251 } |
262 return obj; | 252 return obj; |
263 } | 253 } |
OLD | NEW |