41a930f85bc3988cfbb47a902b03a9830f8149bb - platform/external/skia

commit	41a930f85bc3988cfbb47a902b03a9830f8149bb	[log] [tgz]
author	Mike Reed <reed@google.com>	Wed Jul 26 17:33:44 2017 -0400
committer	Skia Commit-Bot <skia-commit-bot@chromium.org>	Thu Jul 27 12:15:03 2017 +0000
tree	d912d3e1f69ce84cce68199e172e9538d97f49c9
parent	6cd51b51d6603a3100b147c45f38697f2f199fc6 [diff]

Revert "Revert "Fix SkPathRef deserialization malloc crash""

This reverts commit a4ce4b1f6bef22e7ca5c7a952197fc2bc70923fc.

Fix SkPathRef deserialization malloc crash

If the path says it has more points/verbs/etc than the buffer could
be holding, then resetToSize could try to allocate something huge
and crash.

Bug: skia:
Change-Id: I23b8870e9f74386aca89fb8f9a60d3b452044094
Reviewed-on: https://skia-review.googlesource.com/26805
Commit-Queue: Mike Klein <mtklein@chromium.org>
Reviewed-by: Mike Klein <mtklein@chromium.org>

include/core/SkPath.h[diff]
src/core/SkPath.cpp[diff]
src/core/SkPathRef.cpp[diff]
tests/PathTest.cpp[diff]

4 files changed

tree: d912d3e1f69ce84cce68199e172e9538d97f49c9