Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkRegion.cpp

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkRegionPriv.h"
@@ skipping 1082 matching lines @@
 
 bool SkRegion::op(const SkRegion& rgna, const SkRegion& rgnb, Op op) {
     SkDEBUGCODE(this->validate();)
     return SkRegion::Oper(rgna, rgnb, op, this);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 #include "SkBuffer.h"
 
-uint32_t SkRegion::writeToMemory(void* storage) const {
+size_t SkRegion::writeToMemory(void* storage) const {
     if (NULL == storage) {
-        uint32_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
+        size_t size = sizeof(int32_t); // -1 (empty), 0 (rect), runCount
         if (!this->isEmpty()) {
             size += sizeof(fBounds);
             if (this->isComplex()) {
                 size += 2 * sizeof(int32_t);    // ySpanCount + intervalCount
                 size += fRunHead->fRunCount * sizeof(RunType);
             }
         }
         return size;
     }
 
@@ skipping 10 matching lines @@
         if (!isRect) {
             buffer.write32(fRunHead->getYSpanCount());
             buffer.write32(fRunHead->getIntervalCount());
             buffer.write(fRunHead->readonly_runs(),
                          fRunHead->fRunCount * sizeof(RunType));
         }
     }
     return buffer.pos();
 }
 
-uint32_t SkRegion::readFromMemory(const void* storage) {
-    SkRBuffer   buffer(storage);
-    SkRegion    tmp;
-    int32_t     count;
-
+size_t SkRegion::readFromMemory(const void* storage, size_t length) {
+    SkRBufferWithSizeCheck  buffer(storage, length);
+    SkRegion                tmp;
+    int32_t                 count;
+    
     count = buffer.readS32();
     if (count >= 0) {
         buffer.read(&tmp.fBounds, sizeof(tmp.fBounds));
         if (count == 0) {
             tmp.fRunHead = SkRegion_gRectRunHeadPtr;
         } else {
             int32_t ySpanCount = buffer.readS32();
             int32_t intervalCount = buffer.readS32();
-            tmp.allocateRuns(count, ySpanCount, intervalCount);
-            buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
+            if (buffer.isValid()) {
+                tmp.allocateRuns(count, ySpanCount, intervalCount);
+                buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
+            }
         }
     }
-    this->swap(tmp);
-    return buffer.pos();
+    size_t sizeRead = 0;
+    if (buffer.isValid()) {
+        this->swap(tmp);
+        sizeRead = buffer.pos();
+    }
+    return sizeRead;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 const SkRegion& SkRegion::GetEmptyRegion() {
     static SkRegion gEmpty;
     return gEmpty;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
@@ skipping 308 matching lines @@
 bool SkRegion::debugSetRuns(const RunType runs[], int count) {
     // we need to make a copy, since the real method may modify the array, and
     // so it cannot be const.
 
     SkAutoTArray<RunType> storage(count);
     memcpy(storage.get(), runs, count * sizeof(RunType));
     return this->setRuns(storage.get(), count);
 }
 
 #endif