Adding check on input count

src/core/SkImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkImageFilter.h"
 
 #include "SkBitmap.h"
@@ skipping 44 matching lines @@
             && fSrcGenID == other.fSrcGenID;
     }
 };
 
 SkImageFilter::Common::~Common() {
     for (int i = 0; i < fInputs.count(); ++i) {
         SkSafeUnref(fInputs[i]);
     }
 }
 
-void SkImageFilter::Common::allocInputs(int count) {
+bool SkImageFilter::Common::allocInputs(size_t count) {
+    static const size_t maxInputs = ((size_t)(-1)) / sizeof(SkImageFilter*);

[Stephen White, 2015/01/07 19:31:12]

Division is kind of ugly. Could be (moving size computation up):

const uint64_t size64 = sk_mul_64(count, sizeof(SkImageFilter*));
const size_t size = (size_t) size64;
if (size != size64) {
  return false;
}

+    if (count > maxInputs) {
+        return false;
+    }
     const size_t size = count * sizeof(SkImageFilter*);
     fInputs.reset(count);
     sk_bzero(fInputs.get(), size);
+    return true;
 }
 
 void SkImageFilter::Common::detachInputs(SkImageFilter** inputs) {
     const size_t size = fInputs.count() * sizeof(SkImageFilter*);
     memcpy(inputs, fInputs.get(), size);
     sk_bzero(fInputs.get(), size);
 }
 
 bool SkImageFilter::Common::unflatten(SkReadBuffer& buffer, int expectedCount) {
     const int count = buffer.readInt();
-    if (!buffer.validate(count >= 0)) {
-        return false;
-    }
-    if (!buffer.validate(expectedCount < 0 || count == expectedCount)) {
+    if (!buffer.validate((count >= 0) &&
+                         (expectedCount < 0 || count == expectedCount) &&
+                         (this->allocInputs(count)))) {
         return false;
     }
 
-    this->allocInputs(count);
     for (int i = 0; i < count; i++) {
         if (buffer.readBool()) {
             fInputs[i] = buffer.readImageFilter();
         }
         if (!buffer.isValid()) {
             return false;
         }
     }
     SkRect rect;
     buffer.readRect(&rect);
@@ skipping 389 matching lines @@
 
 SkImageFilter::Cache* SkImageFilter::Cache::Create(size_t maxBytes) {
     return SkNEW_ARGS(CacheImpl, (maxBytes));
 }
 
 SK_DECLARE_STATIC_LAZY_PTR(SkImageFilter::Cache, cache, CreateCache);
 
 SkImageFilter::Cache* SkImageFilter::Cache::Get() {
     return cache.get();
 }