Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1008)

Unified Diff: tests/MatrixTest.cpp

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Adding validation before memory allocation in SkRegion::readFromMemory Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: tests/MatrixTest.cpp
diff --git a/tests/MatrixTest.cpp b/tests/MatrixTest.cpp
index 07eacb6f444ac414391ba52ced766d4c143d19c3..e9886941eb4e3b45f561e3eae06a9fe5645bad5d 100644
--- a/tests/MatrixTest.cpp
+++ b/tests/MatrixTest.cpp
@@ -112,18 +112,19 @@ static void test_matrix_recttorect(skiatest::Reporter* reporter) {
static void test_flatten(skiatest::Reporter* reporter, const SkMatrix& m) {
// add 100 in case we have a bug, I don't want to kill my stack in the test
- char buffer[SkMatrix::kMaxFlattenSize + 100];
- uint32_t size1 = m.writeToMemory(NULL);
- uint32_t size2 = m.writeToMemory(buffer);
+ static const size_t kBufferSize = SkMatrix::kMaxFlattenSize + 100;
+ char buffer[kBufferSize];
+ size_t size1 = m.writeToMemory(NULL);
+ size_t size2 = m.writeToMemory(buffer);
REPORTER_ASSERT(reporter, size1 == size2);
REPORTER_ASSERT(reporter, size1 <= SkMatrix::kMaxFlattenSize);
SkMatrix m2;
- uint32_t size3 = m2.readFromMemory(buffer);
+ size_t size3 = m2.readFromMemory(buffer, kBufferSize);
REPORTER_ASSERT(reporter, size1 == size3);
REPORTER_ASSERT(reporter, are_equal(reporter, m, m2));
- char buffer2[SkMatrix::kMaxFlattenSize + 100];
+ char buffer2[kBufferSize];
size3 = m2.writeToMemory(buffer2);
REPORTER_ASSERT(reporter, size1 == size3);
REPORTER_ASSERT(reporter, memcmp(buffer, buffer2, size1) == 0);

Powered by Google App Engine
This is Rietveld 408576698