Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkBuffer.h

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #ifndef SkBuffer_DEFINED
@@ skipping 38 matching lines @@
     size_t  size() const { return fStop - fData; }
     /** Return true if the buffer has read to the end of the data pointer.
         Only defined if the length was specified in the constructor or in a call
         to reset(). Always returns true if the length was not specified.
     */
     bool    eof() const { return fPos >= fStop; }
 
     /** Read the specified number of bytes from the data pointer. If buffer is not
         null, copy those bytes into buffer.
     */
-    void read(void* buffer, size_t size) {
+    virtual void read(void* buffer, size_t size) {
         if (size) {
             this->readNoSizeCheck(buffer, size);
         }
     }
 
     const void* skip(size_t size); // return start of skipped data
     size_t  skipToAlign4();
 
     void*       readPtr() { void* ptr; read(&ptr, sizeof(ptr)); return ptr; }
     SkScalar    readScalar() { SkScalar x; read(&x, 4); return x; }
     uint32_t    readU32() { uint32_t x; read(&x, 4); return x; }
     int32_t     readS32() { int32_t x; read(&x, 4); return x; }
     uint16_t    readU16() { uint16_t x; read(&x, 2); return x; }
     int16_t     readS16() { int16_t x; read(&x, 2); return x; }
     uint8_t     readU8() { uint8_t x; read(&x, 1); return x; }
     bool        readBool() { return this->readU8() != 0; }
 
-private:
+protected:
     void    readNoSizeCheck(void* buffer, size_t size);
 
     const char* fData;
     const char* fPos;
     const char* fStop;
 };
 
+/** \class SkRBufferWithSizeCheck
+
+    Same as SkRBuffer, except that a size check is performed before the read operation and an
+    error is set if the read operation is attempting to read past the end of the data.
+*/
+class SkRBufferWithSizeCheck : public SkRBuffer {
+public:
+    SkRBufferWithSizeCheck(const void* data, size_t size) : SkRBuffer(data, size), fError(false) {}
+
+    /** Read the specified number of bytes from the data pointer. If buffer is not
+        null and the number of bytes to read does not overflow this object's data,
+        copy those bytes into buffer.
+    */
+    virtual void read(void* buffer, size_t size) SK_OVERRIDE;
+
+    /** Returns whether or not a read operation attempted to read past the end of the data.
+    */
+    bool isValid() const { return !fError; }
+private:
+    bool fError;
+};
+
 /** \class SkWBuffer
 
     Light weight class for writing data to a memory block.
     The WBuffer is given the buffer to write into, with either a specified size
     or no size, in which case no range checking is performed. An empty WBuffer
     is legal, in which case no data is ever written, but the relative pos()
     is updated.
 */
 class SkWBuffer : SkNoncopyable {
 public:
@@ skipping 34 matching lines @@
 
 private:
     void    writeNoSizeCheck(const void* buffer, size_t size);
 
     char* fData;
     char* fPos;
     char* fStop;
 };
 
 #endif