Index: src/effects/SkMatrixConvolutionImageFilter.cpp |
diff --git a/src/effects/SkMatrixConvolutionImageFilter.cpp b/src/effects/SkMatrixConvolutionImageFilter.cpp |
index cac30e6a491853ab9907a34cd3df68ba2fa52736..cc86e07adce29b98e3b4e12a0461ef14366e61a3 100644 |
--- a/src/effects/SkMatrixConvolutionImageFilter.cpp |
+++ b/src/effects/SkMatrixConvolutionImageFilter.cpp |
@@ -59,16 +59,20 @@ SkMatrixConvolutionImageFilter::SkMatrixConvolutionImageFilter( |
SkMatrixConvolutionImageFilter::SkMatrixConvolutionImageFilter(SkFlattenableReadBuffer& buffer) |
: INHERITED(buffer) { |
+ // We need to be able to read at most SK_MaxS32 bytes, so divide that |
+ // by the size of a scalar to know how many scalars we can read. |
+ static const int32_t kMaxSize = SK_MaxS32 / sizeof(SkScalar); |
fKernelSize.fWidth = buffer.readInt(); |
fKernelSize.fHeight = buffer.readInt(); |
if ((fKernelSize.fWidth >= 1) && (fKernelSize.fHeight >= 1) && |
// Make sure size won't be larger than a signed int, |
// which would still be extremely large for a kernel, |
// but we don't impose a hard limit for kernel size |
- (SK_MaxS32 / fKernelSize.fWidth >= fKernelSize.fHeight)) { |
+ (kMaxSize / fKernelSize.fWidth >= fKernelSize.fHeight)) { |
uint32_t size = fKernelSize.fWidth * fKernelSize.fHeight; |
fKernel = SkNEW_ARRAY(SkScalar, size); |
- uint32_t readSize = buffer.readScalarArray(fKernel); |
+ uint32_t byteSize = size * sizeof(SkScalar); |
+ uint32_t readSize = buffer.readScalarArray(fKernel, byteSize); |
SkASSERT(readSize == size); |
buffer.validate(readSize == size); |
} else { |