| commit | 796c2040f641bb287dba66c9823ce45e9f8b5807 | [log] [tgz] |
|---|---|---|
| author | Brian Osman <brianosman@google.com> | Thu Aug 29 12:47:48 2024 -0400 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Wed Oct 09 22:51:54 2024 +0000 |
| tree | 0c50f7e5970e06279c46b616e057b2028a18b8d2 | |
| parent | b5543cb8c6b95623743016055220378efe73eb93 [diff] |
RESTRICT AUTOMERGE: Check for size overflow before allocating SkMask data Bug: 352631932 Test: N/A -- not reproducible / speculative fix Reviewed-on: https://skia-review.googlesource.com/c/skia/+/894478 Commit-Queue: Ben Wagner <bungeman@google.com> Reviewed-by: Ben Wagner <bungeman@google.com> Auto-Submit: Brian Osman <brianosman@google.com> (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1fa94ff39bee75fe3a4abf061c09b972e2ffd0fa) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cbf6a5953623cdb0ef200bcba00bc43986b16c91) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a96bda269af74d90cf3993c4429ce9e673a5fc36) Merged-In: I74c081a7b849f13194ec7807b7a748d1919c1bb2 Change-Id: I74c081a7b849f13194ec7807b7a748d1919c1bb2
diff --git a/src/core/SkBlurMF.cpp b/src/core/SkBlurMF.cpp index cd3cd5f..7de3653 100644 --- a/src/core/SkBlurMF.cpp +++ b/src/core/SkBlurMF.cpp
@@ -181,6 +181,9 @@ mask->fRowBytes = SkAlign4(mask->fBounds.width()); mask->fFormat = SkMask::kA8_Format; const size_t size = mask->computeImageSize(); + if (size == 0) { + return false; + } mask->fImage = SkMask::AllocImage(size, SkMask::kZeroInit_Alloc); if (nullptr == mask->fImage) { return false;