Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkRegion.cpp

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkRegionPriv.h"
+#include "SkFlattenableBuffers.h"
 #include "SkTemplates.h"
 #include "SkThread.h"
 #include "SkUtils.h"
 
 /* Region Layout
  *
  *  TOP
  *
  *  [ Bottom, X-Intervals, [Left, Right]..., X-Sentinel ]
  *  ...
@@ skipping 1072 matching lines @@
 
 bool SkRegion::op(const SkRegion& rgna, const SkRegion& rgnb, Op op) {
     SkDEBUGCODE(this->validate();)
     return SkRegion::Oper(rgna, rgnb, op, this);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 #include "SkBuffer.h"
 
+uint32_t SkRegion::sizeInMemory() const {
+    uint32_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
+    if (!this->isEmpty()) {
+        size += sizeof(fBounds);
+        if (this->isComplex()) {
+            size += 2 * sizeof(int32_t);    // ySpanCount + intervalCount
+            size += fRunHead->fRunCount * sizeof(RunType);
+        }
+    }
+    return size;
+}
+
+uint32_t SkRegion::SizeToRead(SkFlattenableReadBuffer& buffer) {
+    uint32_t size = sizeof(int32_t);
+    uint32_t ucount = buffer.getArrayCount();
+    int32_t count = *(int32_t*)ucount; // -1 (empty), 0 (rect), runCount
+    if (count >= 0) {
+        size += sizeof(SkIRect); // fBounds
+        if (count > 0) {
+            size += 2 * sizeof(int32_t);    // ySpanCount + intervalCount
+            size += count * sizeof(RunType);
+        }
+    }
+    return size;
+}
+
 uint32_t SkRegion::writeToMemory(void* storage) const {
     if (NULL == storage) {
-        uint32_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
-        if (!this->isEmpty()) {
-            size += sizeof(fBounds);
-            if (this->isComplex()) {
-                size += 2 * sizeof(int32_t);    // ySpanCount + intervalCount
-                size += fRunHead->fRunCount * sizeof(RunType);
-            }
-        }
-        return size;
+        return sizeInMemory();
     }
 
     SkWBuffer   buffer(storage);
 
     if (this->isEmpty()) {
         buffer.write32(-1);
     } else {
         bool isRect = this->isRect();
 
         buffer.write32(isRect ? 0 : fRunHead->fRunCount);
         buffer.write(&fBounds, sizeof(fBounds));
 
         if (!isRect) {
             buffer.write32(fRunHead->getYSpanCount());
             buffer.write32(fRunHead->getIntervalCount());
             buffer.write(fRunHead->readonly_runs(),
                          fRunHead->fRunCount * sizeof(RunType));
         }
     }
-    return buffer.pos();
+    uint32_t writeSize = SkToU32(buffer.pos());
+    SkASSERT(sizeInMemory() == writeSize);
+    return writeSize;
 }
 
 uint32_t SkRegion::readFromMemory(const void* storage) {
     SkRBuffer   buffer(storage);
     SkRegion    tmp;
     int32_t     count;
 
     count = buffer.readS32();
     if (count >= 0) {
         buffer.read(&tmp.fBounds, sizeof(tmp.fBounds));
         if (count == 0) {
             tmp.fRunHead = SkRegion_gRectRunHeadPtr;
         } else {
             int32_t ySpanCount = buffer.readS32();
             int32_t intervalCount = buffer.readS32();
             tmp.allocateRuns(count, ySpanCount, intervalCount);
             buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
         }
     }
     this->swap(tmp);
-    return buffer.pos();
+    uint32_t readSize = SkToU32(buffer.pos());
+    SkASSERT(sizeInMemory() == readSize);
+    return readSize;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 const SkRegion& SkRegion::GetEmptyRegion() {
     static SkRegion gEmpty;
     return gEmpty;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
@@ skipping 308 matching lines @@
 bool SkRegion::debugSetRuns(const RunType runs[], int count) {
     // we need to make a copy, since the real method may modify the array, and
     // so it cannot be const.
 
     SkAutoTArray<RunType> storage(count);
     memcpy(storage.get(), runs, count * sizeof(RunType));
     return this->setRuns(storage.get(), count);
 }
 
 #endif