Indexed PNG decoding: Ensure color table is large enough that the bit depth of the image will not a…

tests/IndexedPngOverflowTest.cpp

Index: tests/IndexedPngOverflowTest.cpp
diff --git a/tests/IndexedPngOverflowTest.cpp b/tests/IndexedPngOverflowTest.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..e138681bed8fa21fffa56bcf7156a400b8425e82
--- /dev/null
+++ b/tests/IndexedPngOverflowTest.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2011 Google Inc.

[scroggo, 2015/03/05 23:23:30]

2015*

[David Lattimore, 2015/03/06 00:15:26]

Done.

+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include "SkBitmap.h"
+#include "SkBitmapDevice.h"
+#include "SkCanvas.h"
+#include "SkDevice.h"
+#include "SkForceLinking.h"
+#include "SkImageDecoder.h"
+#include "SkImageInfo.h"
+#include "Test.h"
+
+// A 20x1 image with 8 bits per pixel and a palette size of 0. Pixel values are 255, 254... Run
+// this test with ASAN to make sure we don't try to access before/after any palette-sized buffers.
+unsigned char a_png[] = {

[scroggo, 2015/03/05 23:23:30]

gPng*

[David Lattimore, 2015/03/06 00:15:26]

Done.

+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
+  0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x01,
+  0x08, 0x03, 0x00, 0x00, 0x00, 0xe9, 0x4c, 0x7e, 0x17, 0x00, 0x00, 0x00,
+  0x09, 0x70, 0x48, 0x59, 0x73, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00,
+  0x1c, 0x00, 0x0f, 0x01, 0xb9, 0x8f, 0x00, 0x00, 0x00, 0x00, 0x50, 0x4c,
+  0x54, 0x45, 0x4b, 0xa8, 0x89, 0x55, 0x00, 0x00, 0x00, 0x20, 0x49, 0x44,
+  0x41, 0x54, 0x78, 0xda, 0xed, 0xfd, 0x07, 0x01, 0x00, 0x20, 0x08, 0x00,
+  0x41, 0xbc, 0x5b, 0xe8, 0xdf, 0x97, 0x99, 0xe3, 0x92, 0xa0, 0xf2, 0xdf,
+  0x3d, 0x7b, 0x0d, 0xda, 0x04, 0x1c, 0x03, 0xad, 0x00, 0x38, 0x5c, 0x2e,
+  0xad, 0x12, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae, 0x42,
+  0x60, 0x82
+};
+
+DEF_TEST(IndexedPngOverflow, reporter) {
+  SkBitmap image;
+  SkForceLinking(false);
+  bool success = SkImageDecoder::DecodeMemory(
+      a_png, sizeof(a_png), &image, SkColorType::kUnknown_SkColorType,
+      SkImageDecoder::kDecodePixels_Mode);
+  REPORTER_ASSERT(reporter, success);
+
+  SkBitmap bitmap;
+  bitmap.setInfo(SkImageInfo::MakeN32Premul(20, 1)
+                 .makeColorType(kBGRA_8888_SkColorType));

[scroggo, 2015/03/05 23:23:30]

Is there a reason you want BGRA instead of N32 (which is either BGRA or RGBA)?

[David Lattimore, 2015/03/06 00:15:26]

Nope. I just based this off some other code I had where I did have a good
reason, but I don't here. Removed.

+  bitmap.allocPixels();
+  SkBaseDevice* device = new SkBitmapDevice(bitmap);
+  SkCanvas* canvas = new SkCanvas(device);

[scroggo, 2015/03/05 23:23:30]

This is the old way of creating an SkCanvas. Here's the new process:

SkAutoTUnref<SkSurface>
surface(SkSurface::NewRaster(SkImageInfo::MakeN32Premul(20,1)));
SkCanvas* canvas = surface->getCanvas();

[David Lattimore, 2015/03/06 00:15:26]

Done.

+  SkRect destRect = SkRect::MakeXYWH(0, 0, 20, 1);
+  canvas->drawBitmapRect(image, destRect, nullptr);

[scroggo, 2015/03/05 23:23:30]

nit: Most of our code uses NULL. (The only exception I found that uses nullptr
is in Android only code.)

[David Lattimore, 2015/03/06 00:15:26]

Done.

+  canvas->unref();
+  device->unref();
+}