Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(116)

Unified Diff: src/core/SkMatrix.cpp

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Revert back to Patch Set 4 Created 7 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: src/core/SkMatrix.cpp
diff --git a/src/core/SkMatrix.cpp b/src/core/SkMatrix.cpp
index 5bcb35b298874088004f5c39fba7133e85a0c323..192fc1b091edde133ccce2a9b89089371f6503b7 100644
--- a/src/core/SkMatrix.cpp
+++ b/src/core/SkMatrix.cpp
@@ -1923,18 +1923,23 @@ const SkMatrix& SkMatrix::InvalidMatrix() {
uint32_t SkMatrix::writeToMemory(void* buffer) const {
// TODO write less for simple matrices
+ static const uint32_t sizeInMemory = 9 * sizeof(SkScalar);
if (buffer) {
- memcpy(buffer, fMat, 9 * sizeof(SkScalar));
+ memcpy(buffer, fMat, sizeInMemory);
}
- return 9 * sizeof(SkScalar);
+ return sizeInMemory;
}
-uint32_t SkMatrix::readFromMemory(const void* buffer) {
+uint32_t SkMatrix::readFromMemory(const void* buffer, uint32_t length) {
+ static const uint32_t sizeInMemory = 9 * sizeof(SkScalar);
+ if (length < sizeInMemory) {
+ return 0;
+ }
if (buffer) {
- memcpy(fMat, buffer, 9 * sizeof(SkScalar));
+ memcpy(fMat, buffer, sizeInMemory);
this->setTypeMask(kUnknown_Mask);
}
- return 9 * sizeof(SkScalar);
+ return sizeInMemory;
}
#ifdef SK_DEVELOPER
« include/core/SkReader32.h ('K') | « src/core/SkBuffer.cpp ('k') | src/core/SkPath.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698