Verify size_t overflow

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1184 matching lines @@
 
     SkImageInfo info;
     info.unflatten(*buffer);
 
     // If there was an error reading "info", don't use it to compute minRowBytes()
     if (!buffer->validate(true)) {
         return false;
     }
 
     const size_t ramRB = info.minRowBytes();
-    const int height = info.height();
-    const size_t snugSize = snugRB * height;
-    const size_t ramSize = ramRB * height;
-    if (!buffer->validate(snugSize <= ramSize)) {
+    const int height = SkMax32(info.height(), 0);
+    const uint64_t snugSize = sk_64_mul(snugRB, height);
+    const uint64_t ramSize = sk_64_mul(ramRB, height);
+    static const uint64_t max_size_t = (size_t)(-1);
+    if (!buffer->validate((snugSize <= ramSize) && (ramSize <= max_size_t))) {

[Stephen White, 2015/01/07 19:22:29]

static const uint64_t max_size_t = (size_t)(-1);
if (!buffer->validate((snugSize <= ramSize) && (ramSize <= max_size_t))) {

Nit: I think this could be slightly shorter as:

if (!buffer->validate((snugSize <= ramSize) && (ramSize == (size_t) ramSize))) {

I leave it up to you guys to say if it's clearer or not.

         return false;
     }
 
-    SkAutoDataUnref data(SkData::NewUninitialized(ramSize));
+    SkAutoDataUnref data(SkData::NewUninitialized(SkToSizeT(ramSize)));
     char* dst = (char*)data->writable_data();
-    buffer->readByteArray(dst, snugSize);
+    buffer->readByteArray(dst, SkToSizeT(snugSize));
 
     if (snugSize != ramSize) {
         const char* srcRow = dst + snugRB * (height - 1);
         char* dstRow = dst + ramRB * (height - 1);
         for (int y = height - 1; y >= 1; --y) {
             memmove(dstRow, srcRow, snugRB);
             srcRow -= snugRB;
             dstRow -= ramRB;
         }
         SkASSERT(srcRow == dstRow); // first row does not need to be moved
@@ skipping 153 matching lines @@
 ///////////////////////////////////////////////////////////////////////////////
 
 #ifdef SK_DEBUG
 void SkImageInfo::validate() const {
     SkASSERT(fWidth >= 0);
     SkASSERT(fHeight >= 0);
     SkASSERT(SkColorTypeIsValid(fColorType));
     SkASSERT(SkAlphaTypeIsValid(fAlphaType));
 }
 #endif