Index: src/core/SkBitmap.cpp |
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp |
index 05f5208a69bfd62fba985d9f2e54e59d4853bb0d..046e20ab62b416f45f347efbbc14de833bcecccd 100644 |
--- a/src/core/SkBitmap.cpp |
+++ b/src/core/SkBitmap.cpp |
@@ -19,6 +19,7 @@ |
#include "SkThread.h" |
#include "SkUnPreMultiply.h" |
#include "SkUtils.h" |
+#include "SkValidationUtils.h" |
#include "SkPackBits.h" |
#include <new> |
@@ -268,7 +269,7 @@ void SkBitmap::getBounds(SkIRect* bounds) const { |
/////////////////////////////////////////////////////////////////////////////// |
static bool validate_alphaType(SkBitmap::Config config, SkAlphaType alphaType, |
- SkAlphaType* canonical) { |
+ SkAlphaType* canonical = NULL) { |
switch (config) { |
case SkBitmap::kNo_Config: |
alphaType = kIgnore_SkAlphaType; |
@@ -1604,10 +1605,12 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
int width = buffer.readInt(); |
int height = buffer.readInt(); |
int rowBytes = buffer.readInt(); |
- int config = buffer.readInt(); |
- int alphaType = buffer.readInt(); |
+ Config config = (Config)buffer.readInt(); |
+ SkAlphaType alphaType = (SkAlphaType)buffer.readInt(); |
+ buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) && |
+ SkIsValidConfig(config) && validate_alphaType(config, alphaType)); |
- this->setConfig((Config)config, width, height, rowBytes, (SkAlphaType)alphaType); |
+ this->setConfig(config, width, height, rowBytes, alphaType); |
int reftype = buffer.readInt(); |
switch (reftype) { |
@@ -1620,6 +1623,7 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) { |
case SERIALIZE_PIXELTYPE_NONE: |
break; |
default: |
+ buffer.validate(false); |
SkDEBUGFAIL("unrecognized pixeltype in serialized data"); |
sk_throw(); |
} |