Index: src/core/SkValidatingReadBuffer.cpp |
diff --git a/src/core/SkValidatingReadBuffer.cpp b/src/core/SkValidatingReadBuffer.cpp |
index a0e1a4179f2cd18ff431203aa8b1091102a68ec7..b890c2653ed60d53db8d4a90c78f081d703042f0 100644 |
--- a/src/core/SkValidatingReadBuffer.cpp |
+++ b/src/core/SkValidatingReadBuffer.cpp |
@@ -113,11 +113,9 @@ void SkValidatingReadBuffer::readPoint(SkPoint* point) { |
} |
void SkValidatingReadBuffer::readMatrix(SkMatrix* matrix) { |
- const size_t size = matrix->readFromMemory(fReader.peek()); |
- fError = fError || (SkAlign4(size) != size); |
- if (!fError) { |
- (void)this->skip(size); |
- } |
+ matrix->setAll(this->readScalar(), this->readScalar(), this->readScalar(), |
+ this->readScalar(), this->readScalar(), this->readScalar(), |
+ this->readScalar(), this->readScalar(), this->readScalar()); |
} |
void SkValidatingReadBuffer::readIRect(SkIRect* rect) { |
@@ -135,16 +133,16 @@ void SkValidatingReadBuffer::readRect(SkRect* rect) { |
} |
void SkValidatingReadBuffer::readRegion(SkRegion* region) { |
- const size_t size = region->readFromMemory(fReader.peek()); |
- fError = fError || (SkAlign4(size) != size); |
+ const size_t size = region->readFromMemory(fReader.peek(), fReader.available()); |
+ fError = fError || (SkAlign4(size) != size) || (0 == size); |
if (!fError) { |
(void)this->skip(size); |
} |
} |
void SkValidatingReadBuffer::readPath(SkPath* path) { |
- const size_t size = path->readFromMemory(fReader.peek()); |
- fError = fError || (SkAlign4(size) != size); |
+ const size_t size = path->readFromMemory(fReader.peek(), fReader.available()); |
+ fError = fError || (SkAlign4(size) != size) || (0 == size); |
if (!fError) { |
(void)this->skip(size); |
} |
@@ -205,6 +203,8 @@ uint32_t SkValidatingReadBuffer::readScalarArray(SkScalar* values) { |
} |
uint32_t SkValidatingReadBuffer::getArrayCount() { |
+ const size_t inc = sizeof(uint32_t); |
+ fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc); |
return *(uint32_t*)fReader.peek(); |
} |