Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(32)

Unified Diff: include/core/SkRegion.h

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Adding validation before memory allocation in SkRegion::readFromMemory Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: include/core/SkRegion.h
diff --git a/include/core/SkRegion.h b/include/core/SkRegion.h
index a088d546200be5211aff976fddc2118a1b392af1..c9aa8daf880be37b4b5f3196d54f7ade25fdb2dc 100644
--- a/include/core/SkRegion.h
+++ b/include/core/SkRegion.h
@@ -361,13 +361,16 @@ public:
* Write the region to the buffer, and return the number of bytes written.
* If buffer is NULL, it still returns the number of bytes.
*/
- uint32_t writeToMemory(void* buffer) const;
-
+ size_t writeToMemory(void* buffer) const;
/**
- * Initialized the region from the buffer, returning the number
- * of bytes actually read.
+ * Initializes the region from the buffer
+ *
+ * @param buffer Memory to read from
+ * @param length Amount of memory available in the buffer
+ * @return number of bytes read (must be a multiple of 4) or
+ * 0 if there was not enough memory available
*/
- uint32_t readFromMemory(const void* buffer);
+ size_t readFromMemory(const void* buffer, size_t length);
/**
* Returns a reference to a global empty region. Just a convenience for

Powered by Google App Engine
This is Rietveld 408576698