Index: src/core/SkPath.cpp |
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp |
index 9df62850fd2eb5bc9cf442dc4675b7091cded8c1..33ec801a72f35268e15d1ca1573c5c6a99d82389 100644 |
--- a/src/core/SkPath.cpp |
+++ b/src/core/SkPath.cpp |
@@ -2113,8 +2113,8 @@ uint32_t SkPath::writeToMemory(void* storage) const { |
return SkToU32(buffer.pos()); |
} |
-uint32_t SkPath::readFromMemory(const void* storage) { |
- SkRBuffer buffer(storage); |
+uint32_t SkPath::readFromMemory(const void* storage, uint32_t length) { |
+ SkRBufferWithSizeCheck buffer(storage, length); |
uint32_t packed = buffer.readS32(); |
fIsOval = (packed >> kIsOval_SerializationShift) & 1; |
@@ -2128,16 +2128,16 @@ uint32_t SkPath::readFromMemory(const void* storage) { |
fPathRef.reset(SkPathRef::CreateFromBuffer(&buffer |
#ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO |
- , newFormat, packed) |
+ , newFormat, packed |
#endif |
- ); |
+ )); |
buffer.skipToAlign4(); |
GEN_ID_INC; |
SkDEBUGCODE(this->validate();) |
- return SkToU32(buffer.pos()); |
+ return buffer.isValid() ? SkToU32(buffer.pos()) : 0; |
} |
/////////////////////////////////////////////////////////////////////////////// |