Adding more validation

src/effects/SkMergeImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkMergeImageFilter.h"
 #include "SkCanvas.h"
 #include "SkDevice.h"
 #include "SkFlattenableBuffers.h"
 #include "SkValidationUtils.h"
 
+// Use 65535 as an arbitrary large number of inputs that this image filter should never overflow
+static const int kMaxInputs = 65535;
+
 ///////////////////////////////////////////////////////////////////////////////
 
 void SkMergeImageFilter::initAllocModes() {
     int inputCount = countInputs();
     if (inputCount) {
         size_t size = sizeof(uint8_t) * inputCount;
         if (size <= sizeof(fStorage)) {
             fModes = SkTCast<uint8_t*>(fStorage);
         } else {
             fModes = SkTCast<uint8_t*>(sk_malloc_throw(size));
@@ skipping 22 matching lines @@
         SkXfermode::Mode modes[] = { mode, mode };
         this->initModes(modes);
     } else {
         fModes = NULL;
     }
 }
 
 SkMergeImageFilter::SkMergeImageFilter(SkImageFilter* filters[], int count,
                                        const SkXfermode::Mode modes[],
                                        const CropRect* cropRect) : INHERITED(count, filters, cropRect) {
+    SkASSERT(count <= kMaxInputs);
     this->initModes(modes);
 }
 
 SkMergeImageFilter::~SkMergeImageFilter() {
 
     if (fModes != SkTCast<uint8_t*>(fStorage)) {
         sk_free(fModes);
     }
 }
 
@@ skipping 83 matching lines @@
 
 void SkMergeImageFilter::flatten(SkFlattenableWriteBuffer& buffer) const {
     this->INHERITED::flatten(buffer);
 
     buffer.writeBool(fModes != NULL);
     if (fModes) {
         buffer.writeByteArray(fModes, countInputs() * sizeof(fModes[0]));
     }
 }
 
-SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer)
+  : INHERITED(kMaxInputs, buffer) {
     bool hasModes = buffer.readBool();
     if (hasModes) {
         this->initAllocModes();
         int nbInputs = countInputs();
         size_t size = nbInputs * sizeof(fModes[0]);
         SkASSERT(buffer.getArrayCount() == size);
         buffer.readByteArray(fModes, size);
         for (int i = 0; i < nbInputs; ++i) {
             buffer.validate(SkIsValidMode((SkXfermode::Mode)fModes[i]));
         }
     } else {
         fModes = 0;
     }
 }