Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(4)

Side by Side Diff: tests/PathTest.cpp

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Adding validation before memory allocation in SkRegion::readFromMemory Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 /* 1 /*
2 * Copyright 2011 Google Inc. 2 * Copyright 2011 Google Inc.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license that can be 4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file. 5 * found in the LICENSE file.
6 */ 6 */
7 7
8 #include "Test.h" 8 #include "Test.h"
9 #include "SkCanvas.h" 9 #include "SkCanvas.h"
10 #include "SkPaint.h" 10 #include "SkPaint.h"
(...skipping 1790 matching lines...) Expand 10 before | Expand all | Expand 10 after
1801 p.moveTo(pts[0]); 1801 p.moveTo(pts[0]);
1802 p.lineTo(pts[1]); 1802 p.lineTo(pts[1]);
1803 p.quadTo(pts[2], pts[3]); 1803 p.quadTo(pts[2], pts[3]);
1804 p.cubicTo(pts[4], pts[5], pts[6]); 1804 p.cubicTo(pts[4], pts[5], pts[6]);
1805 1805
1806 write_and_read_back(reporter, p); 1806 write_and_read_back(reporter, p);
1807 1807
1808 // create a buffer that should be much larger than the path so we don't 1808 // create a buffer that should be much larger than the path so we don't
1809 // kill our stack if writer goes too far. 1809 // kill our stack if writer goes too far.
1810 char buffer[1024]; 1810 char buffer[1024];
1811 uint32_t size1 = p.writeToMemory(NULL); 1811 size_t size1 = p.writeToMemory(NULL);
1812 uint32_t size2 = p.writeToMemory(buffer); 1812 size_t size2 = p.writeToMemory(buffer);
1813 REPORTER_ASSERT(reporter, size1 == size2); 1813 REPORTER_ASSERT(reporter, size1 == size2);
1814 1814
1815 SkPath p2; 1815 SkPath p2;
1816 uint32_t size3 = p2.readFromMemory(buffer); 1816 size_t size3 = p2.readFromMemory(buffer, 1024);
1817 REPORTER_ASSERT(reporter, size1 == size3); 1817 REPORTER_ASSERT(reporter, size1 == size3);
1818 REPORTER_ASSERT(reporter, p == p2); 1818 REPORTER_ASSERT(reporter, p == p2);
1819 1819
1820 char buffer2[1024]; 1820 char buffer2[1024];
1821 size3 = p2.writeToMemory(buffer2); 1821 size3 = p2.writeToMemory(buffer2);
1822 REPORTER_ASSERT(reporter, size1 == size3); 1822 REPORTER_ASSERT(reporter, size1 == size3);
1823 REPORTER_ASSERT(reporter, memcmp(buffer, buffer2, size1) == 0); 1823 REPORTER_ASSERT(reporter, memcmp(buffer, buffer2, size1) == 0);
1824 1824
1825 // test persistence of the oval flag & convexity 1825 // test persistence of the oval flag & convexity
1826 { 1826 {
(...skipping 843 matching lines...) Expand 10 before | Expand all | Expand 10 after
2670 test_bad_cubic_crbug229478(); 2670 test_bad_cubic_crbug229478();
2671 test_bad_cubic_crbug234190(); 2671 test_bad_cubic_crbug234190();
2672 test_android_specific_behavior(reporter); 2672 test_android_specific_behavior(reporter);
2673 test_gen_id(reporter); 2673 test_gen_id(reporter);
2674 test_path_close_issue1474(reporter); 2674 test_path_close_issue1474(reporter);
2675 test_path_to_region(reporter); 2675 test_path_to_region(reporter);
2676 } 2676 }
2677 2677
2678 #include "TestClassDef.h" 2678 #include "TestClassDef.h"
2679 DEFINE_TESTCLASS("Path", PathTestClass, TestPath) 2679 DEFINE_TESTCLASS("Path", PathTestClass, TestPath)
OLDNEW
« no previous file with comments | « tests/MatrixTest.cpp ('k') | tests/SerializationTest.cpp » ('j') | tests/SerializationTest.cpp » ('J')

Powered by Google App Engine
This is Rietveld 408576698