Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

include/core/SkMatrix.h

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #ifndef SkMatrix_DEFINED
@@ skipping 542 matching lines @@
     friend bool operator!=(const SkMatrix& a, const SkMatrix& b) {
         return !(a == b);
     }
 
     enum {
         // writeTo/readFromMemory will never return a value larger than this
         kMaxFlattenSize = 9 * sizeof(SkScalar) + sizeof(uint32_t)
     };
     // return the number of bytes written, whether or not buffer is null
     uint32_t writeToMemory(void* buffer) const;
     // return the number of bytes read

[reed1, 2013/10/25 14:42:46]

// Please document what 'length' is used for.

[sugoi1, 2013/10/25 14:59:02]

Done.

-    uint32_t readFromMemory(const void* buffer);
+    uint32_t readFromMemory(const void* buffer, uint32_t length);
 
     SkDEVCODE(void dump() const;)
     SkDEVCODE(void toString(SkString*) const;)
 
     /**
      * Calculates the maximum stretching factor of the matrix. If the matrix has
      * perspective -1 is returned.
      *
      * @return maximum strecthing factor
      */
@@ skipping 115 matching lines @@
     static void RotTrans_pts(const SkMatrix&, SkPoint dst[], const SkPoint[],
                              int count);
     static void Persp_pts(const SkMatrix&, SkPoint dst[], const SkPoint[], int);
 
     static const MapPtsProc gMapPtsProcs[];
 
     friend class SkPerspIter;
 };
 
 #endif