Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(554)

Unified Diff: src/core/SkRRect.cpp

Issue 41253002: Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream. (Closed) Base URL: https://skia.googlecode.com/svn/trunk
Patch Set: Fixed comments and added tests Created 7 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: src/core/SkRRect.cpp
diff --git a/src/core/SkRRect.cpp b/src/core/SkRRect.cpp
index 75af106b7b6eaf81183ce1b977afa27231577aa3..8338bf727cec14068c29783273decb61a2bfaa7e 100644
--- a/src/core/SkRRect.cpp
+++ b/src/core/SkRRect.cpp
@@ -280,7 +280,7 @@ void SkRRect::inset(SkScalar dx, SkScalar dy, SkRRect* dst) const {
///////////////////////////////////////////////////////////////////////////////
-uint32_t SkRRect::writeToMemory(void* buffer) const {
+size_t SkRRect::writeToMemory(void* buffer) const {
SkASSERT(kSizeInMemory == sizeof(SkRect) + sizeof(fRadii));
memcpy(buffer, &fRect, sizeof(SkRect));
@@ -288,7 +288,11 @@ uint32_t SkRRect::writeToMemory(void* buffer) const {
return kSizeInMemory;
}
-uint32_t SkRRect::readFromMemory(const void* buffer) {
+size_t SkRRect::readFromMemory(const void* buffer, size_t length) {
+ if (length < kSizeInMemory) {
+ return 0;
+ }
+
SkScalar storage[12];
SkASSERT(sizeof(storage) == kSizeInMemory);
« include/core/SkReader32.h ('K') | « src/core/SkPath.cpp ('k') | src/core/SkRegion.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698