commit ca95c19d27b505a1ac8f57b53cb49c198bc29267
author sugoi <sugoi@chromium.org> Tue Jul 08 09:18:48 2014 -0700
committer Commit bot <commit-bot@chromium.org> Tue Jul 08 09:18:48 2014 -0700
tree 485a9a5eeed346af68b8ff80d19d5dfafb316af7
parent 9ea3d57fde28a5fe4487a111dc3dd49418235e5e

Adding validation before using an SkImageInfo object read from an SkReadBuffer.

BUG=389574
R=senorblanco@google.com, reed@google.com, senorblanco@chromium.org

Author: sugoi@chromium.org

Review URL: https://codereview.chromium.org/376803004

src/core/SkBitmap.cpp

diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index a40f61a..651152e 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1201,6 +1201,11 @@
     SkImageInfo info;
     info.unflatten(*buffer);
 
+    // If there was an error reading "info", don't use it to compute minRowBytes()
+    if (!buffer->validate(true)) {
+        return false;
+    }
+
     const size_t ramRB = info.minRowBytes();
     const int height = info.height();
     const size_t snugSize = snugRB * height;