Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(968)

Unified Diff: src/core/SkBuffer.cpp

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Adding validation before memory allocation in SkRegion::readFromMemory Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: src/core/SkBuffer.cpp
diff --git a/src/core/SkBuffer.cpp b/src/core/SkBuffer.cpp
index 915264d957f057840da9d831a05aa242e50132cc..32a8011ac787a34f26ab1f57869aba1b7b5e180e 100644
--- a/src/core/SkBuffer.cpp
+++ b/src/core/SkBuffer.cpp
@@ -34,6 +34,13 @@ size_t SkRBuffer::skipToAlign4()
return n;
}
+void SkRBufferWithSizeCheck::read(void* buffer, size_t size) {
+ fError = fError || (fPos + size > fStop);
+ if (!fError && (size > 0)) {
+ readNoSizeCheck(buffer, size);
+ }
+}
+
void* SkWBuffer::skip(size_t size)
{
void* result = fPos;
« no previous file with comments | « src/core/SkBuffer.h ('k') | src/core/SkMatrix.cpp » ('j') | tests/SerializationTest.cpp » ('J')

Powered by Google App Engine
This is Rietveld 408576698