Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/pipe/SkGPipeWrite.cpp

 
 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkAnnotation.h"
 #include "SkBitmapDevice.h"
@@ skipping 591 matching lines @@
             fWriter.writeScalar(sx);
             fWriter.writeScalar(sy);
         }
     }
     return this->INHERITED::skew(sx, sy);
 }
 
 bool SkGPipeCanvas::concat(const SkMatrix& matrix) {
     if (!matrix.isIdentity()) {
         NOTIFY_SETUP(this);
-        if (this->needOpBytes(matrix.writeToMemory(NULL))) {
+        if (this->needOpBytes(fWriter.writeMatrixSize(matrix))) {
             this->writeOp(kConcat_DrawOp);
             fWriter.writeMatrix(matrix);
         }
     }
     return this->INHERITED::concat(matrix);
 }
 
 void SkGPipeCanvas::setMatrix(const SkMatrix& matrix) {
     NOTIFY_SETUP(this);
-    if (this->needOpBytes(matrix.writeToMemory(NULL))) {
+    if (this->needOpBytes(fWriter.writeMatrixSize(matrix))) {
         this->writeOp(kSetMatrix_DrawOp);
         fWriter.writeMatrix(matrix);
     }
     this->INHERITED::setMatrix(matrix);
 }
 
 bool SkGPipeCanvas::clipRect(const SkRect& rect, SkRegion::Op rgnOp,
                              bool doAntiAlias) {
     NOTIFY_SETUP(this);
     if (this->needOpBytes(sizeof(SkRect))) {
@@ skipping 161 matching lines @@
         if (hasSrc) {
             fWriter.writeRect(*src);
         }
         fWriter.writeRect(dst);
     }
 }
 
 void SkGPipeCanvas::drawBitmapMatrix(const SkBitmap& bm, const SkMatrix& matrix,
                                      const SkPaint* paint) {
     NOTIFY_SETUP(this);
-    size_t opBytesNeeded = matrix.writeToMemory(NULL);
+    size_t opBytesNeeded = fWriter.writeMatrixSize(matrix);
 
     if (this->commonDrawBitmap(bm, kDrawBitmapMatrix_DrawOp, 0, opBytesNeeded, paint)) {
         fWriter.writeMatrix(matrix);
     }
 }
 
 void SkGPipeCanvas::drawBitmapNine(const SkBitmap& bm, const SkIRect& center,
                                    const SkRect& dst, const SkPaint* paint) {
     NOTIFY_SETUP(this);
     size_t opBytesNeeded = sizeof(int32_t) * 4 + sizeof(SkRect);
@@ skipping 69 matching lines @@
 
 void SkGPipeCanvas::drawTextOnPath(const void* text, size_t byteLength,
                                    const SkPath& path, const SkMatrix* matrix,
                                    const SkPaint& paint) {
     if (byteLength) {
         NOTIFY_SETUP(this);
         unsigned flags = 0;
         size_t size = 4 + SkAlign4(byteLength) + path.writeToMemory(NULL);
         if (matrix) {
             flags |= kDrawTextOnPath_HasMatrix_DrawOpFlag;
-            size += matrix->writeToMemory(NULL);
+            size += fWriter.writeMatrixSize(*matrix);
         }
         this->writePaint(paint);
         if (this->needOpBytes(size)) {
             this->writeOp(kDrawTextOnPath_DrawOp, flags, 0);
 
             fWriter.write32(byteLength);
             fWriter.writePad(text, byteLength);
 
             fWriter.writePath(path);
             if (matrix) {
@@ skipping 305 matching lines @@
     fCanvas->ref();
 }
 
 BitmapShuttle::~BitmapShuttle() {
     fCanvas->unref();
 }
 
 bool BitmapShuttle::insert(const SkBitmap& bitmap, int32_t slot) {
     return fCanvas->shuttleBitmap(bitmap, slot);
 }