Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Side by Side Diff: src/images/SkImageDecoder_libico.cpp

Issue 505153003: Fix overflow when comparing two ints by promoting the sum to 64-bits. (Closed) Base URL: https://skia.googlesource.com/skia.git@master
Patch Set: Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright 2006 The Android Open Source Project 2 * Copyright 2006 The Android Open Source Project
3 * 3 *
4 * Use of this source code is governed by a BSD-style license that can be 4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file. 5 * found in the LICENSE file.
6 */ 6 */
7 7
8 #include "SkColorPriv.h" 8 #include "SkColorPriv.h"
9 #include "SkImageDecoder.h" 9 #include "SkImageDecoder.h"
10 #include "SkStream.h" 10 #include "SkStream.h"
(...skipping 136 matching lines...) Expand 10 before | Expand all | Expand 10 after
147 //commented out lines are not used, but if i switch to other read method, ne ed to know how many to skip 147 //commented out lines are not used, but if i switch to other read method, ne ed to know how many to skip
148 //otherwise, they could be used for error checking 148 //otherwise, they could be used for error checking
149 int w = readByte(buf, 6 + choice*16); 149 int w = readByte(buf, 6 + choice*16);
150 int h = readByte(buf, 7 + choice*16); 150 int h = readByte(buf, 7 + choice*16);
151 int colorCount = readByte(buf, 8 + choice*16); 151 int colorCount = readByte(buf, 8 + choice*16);
152 //int reservedToo = readByte(buf, 9 + choice*16); //0 152 //int reservedToo = readByte(buf, 9 + choice*16); //0
153 //int planes = read2Bytes(buf, 10 + choice*16); //1 - but often 0 153 //int planes = read2Bytes(buf, 10 + choice*16); //1 - but often 0
154 //int fakeBitCount = read2Bytes(buf, 12 + choice*16); //should be real - usu ally 0 154 //int fakeBitCount = read2Bytes(buf, 12 + choice*16); //should be real - usu ally 0
155 const size_t size = read4Bytes(buf, 14 + choice*16); //matters? 155 const size_t size = read4Bytes(buf, 14 + choice*16); //matters?
156 const size_t offset = read4Bytes(buf, 18 + choice*16); 156 const size_t offset = read4Bytes(buf, 18 + choice*16);
157 if ((offset + size) > length) { 157 if (((uint64_t)offset + size) > length) {
reed1 2014/08/26 14:48:23 I suggest a comment to explain why we're using the
158 return false; 158 return false;
159 } 159 }
160 160
161 // Check to see if this is a PNG image inside the ICO 161 // Check to see if this is a PNG image inside the ICO
162 { 162 {
163 SkMemoryStream subStream(buf + offset, size, false); 163 SkMemoryStream subStream(buf + offset, size, false);
164 SkAutoTDelete<SkImageDecoder> otherDecoder(SkImageDecoder::Factory(&subS tream)); 164 SkAutoTDelete<SkImageDecoder> otherDecoder(SkImageDecoder::Factory(&subS tream));
165 if (otherDecoder.get() != NULL) { 165 if (otherDecoder.get() != NULL) {
166 // Set fields on the other decoder to be the same as this one. 166 // Set fields on the other decoder to be the same as this one.
167 this->copyFieldsToOther(otherDecoder.get()); 167 this->copyFieldsToOther(otherDecoder.get());
(...skipping 245 matching lines...) Expand 10 before | Expand all | Expand 10 after
413 static SkImageDecoder_DecodeReg gReg(sk_libico_dfactory); 413 static SkImageDecoder_DecodeReg gReg(sk_libico_dfactory);
414 414
415 static SkImageDecoder::Format get_format_ico(SkStreamRewindable* stream) { 415 static SkImageDecoder::Format get_format_ico(SkStreamRewindable* stream) {
416 if (is_ico(stream)) { 416 if (is_ico(stream)) {
417 return SkImageDecoder::kICO_Format; 417 return SkImageDecoder::kICO_Format;
418 } 418 }
419 return SkImageDecoder::kUnknown_Format; 419 return SkImageDecoder::kUnknown_Format;
420 } 420 }
421 421
422 static SkImageDecoder_FormatReg gFormatReg(get_format_ico); 422 static SkImageDecoder_FormatReg gFormatReg(get_format_ico);
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698