commit d4fb1c48310238ddd788ac32ce294119d3110dc9
author zoran.jovanovic <zoran.jovanovic@sonymobile.com> Thu Apr 16 11:03:16 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 13:57:29 2015 -0700
tree 72543d9e0b732a10ad99bb2e16926756b27680dc
parent e28401bea8a6671dd1d8b0cab639c315ff6572fc

SkScaledBitmapSampler: fix memory overwritten

Cherry-picked from https://codereview.chromium.org/1085253002
in Skia.

Memory will be overwritten while downsampling some
interlaced gif images, most commonly with odd sizes,
when index of destination row stores in the current
line computed from GifInterlaceIter meets:

 X is an integer in [0..height-1]
   and
 (X < height)
 && ((X - sampleSize/2) % sampleSize == 0)
 && ((X - sampleSize/2)/sampleSize >= height/sampleSize)

Signed-off-by: Lu Tong <lu.x.tong@sonymobile.com>

BUG=skia:

Review URL: https://codereview.chromium.org/1085253002

BUG:20723696
Change-Id: I2cca83a2a5c39b5a497f36b40724262b438ead8b

src/images/SkScaledBitmapSampler.cpp

diff --git a/src/images/SkScaledBitmapSampler.cpp b/src/images/SkScaledBitmapSampler.cpp
index fe425d5..788bcd4 100644
--- a/src/images/SkScaledBitmapSampler.cpp
+++ b/src/images/SkScaledBitmapSampler.cpp
@@ -763,7 +763,9 @@
     // of the destination bitmap's pixels, which is used to calculate the destination row
     // each time this function is called.
     const int dstY = srcYMinusY0 / fDY;
-    SkASSERT(dstY < fScaledHeight);
+    if (dstY >= fScaledHeight) {
+        return false;
+    }
     char* dstRow = fDstRow + dstY * fDstRowBytes;
     return fRowProc(dstRow, src + fX0 * fSrcPixelSize, fScaledWidth,
                     fDX * fSrcPixelSize, dstY, fCTable);