| Index: src/core/SkImageFilter.cpp
|
| diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
|
| index 4a9a22e63445bde4b0c6705403fe0dc08ee31805..4f2251eee186bd5f2018599eafa445b9d27d47ca 100644
|
| --- a/src/core/SkImageFilter.cpp
|
| +++ b/src/core/SkImageFilter.cpp
|
| @@ -75,9 +75,9 @@ void SkImageFilter::Common::detachInputs(SkImageFilter** inputs) {
|
| }
|
|
|
| bool SkImageFilter::Common::unflatten(SkReadBuffer& buffer, int expectedCount) {
|
| - int count = buffer.readInt();
|
| - if (expectedCount < 0) { // means the caller doesn't care how many
|
| - expectedCount = count;
|
| + const int count = buffer.readInt();
|
| + if (!buffer.validate(count >= 0)) {
|
| + return false;
|
| }
|
| if (!buffer.validate((count == expectedCount) && (count >= 0))) {
|
| return false;
|
|
|