commit fc7063b3a50f4cf0801301f7b7b7b119f6b41cf8
author scroggo <scroggo@google.com> Fri Jul 25 13:54:43 2014 -0700
committer Commit bot <commit-bot@chromium.org> Fri Jul 25 13:54:43 2014 -0700
tree 19ad14f5c6c31ab1f1ced475ab5c73c97940d6d3
parent d6aeb6dc8fe21066f1a2c4813a4256a3acd3edf5

Fix image decoder memory overwrite bug.

In SkPNGImageDecoder::onDecodeSubset, use png_read_rows to write to
the scratch memory provided. This is what we should have been doing
anyway. Further, writing directly to the bitmap can cause writing
to the wrong memory since the bitmap may not be as big as the
scratch memory in the case of sampling with a short bitmap.

Bug=b/13921093

R=djsollen@google.com

Author: scroggo@google.com

Review URL: https://codereview.chromium.org/423473003

src/images/SkImageDecoder_libpng.cpp

diff --git a/src/images/SkImageDecoder_libpng.cpp b/src/images/SkImageDecoder_libpng.cpp
index 7ff1558..01b7c69 100644
--- a/src/images/SkImageDecoder_libpng.cpp
+++ b/src/images/SkImageDecoder_libpng.cpp
@@ -911,8 +911,7 @@
             for (int i = 0; i < number_passes; i++) {
                 png_configure_decoder(png_ptr, &actualTop, i);
                 for (int j = 0; j < rect.fTop - actualTop; j++) {
-                    uint8_t* bmRow = (uint8_t*)decodedBitmap.getPixels();
-                    png_read_rows(png_ptr, &bmRow, png_bytepp_NULL, 1);
+                    png_read_rows(png_ptr, &base, png_bytepp_NULL, 1);
                 }
                 uint8_t* row = base;
                 for (int32_t y = 0; y < rect.height(); y++) {
@@ -935,8 +934,7 @@
             skip_src_rows(png_ptr, srcRow, sampler.srcY0());
 
             for (int i = 0; i < rect.fTop - actualTop; i++) {
-                uint8_t* bmRow = (uint8_t*)decodedBitmap.getPixels();
-                png_read_rows(png_ptr, &bmRow, png_bytepp_NULL, 1);
+                png_read_rows(png_ptr, &srcRow, png_bytepp_NULL, 1);
             }
             for (int y = 0; y < height; y++) {
                 uint8_t* tmp = srcRow;