Revert "Revert "Fix SkPathRef deserialization malloc crash""
This reverts commit a4ce4b1f6bef22e7ca5c7a952197fc2bc70923fc.
Fix SkPathRef deserialization malloc crash
If the path says it has more points/verbs/etc than the buffer could
be holding, then resetToSize could try to allocate something huge
and crash.
Bug: skia:
Change-Id: I23b8870e9f74386aca89fb8f9a60d3b452044094
Reviewed-on: https://skia-review.googlesource.com/26805
Commit-Queue: Mike Klein <mtklein@chromium.org>
Reviewed-by: Mike Klein <mtklein@chromium.org>
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index 2be3251..e304b4d 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -8,6 +8,7 @@
#include <cmath>
#include "SkBuffer.h"
#include "SkCubicClipper.h"
+#include "SkData.h"
#include "SkGeometry.h"
#include "SkMath.h"
#include "SkPathPriv.h"
@@ -2061,6 +2062,13 @@
return buffer.pos();
}
+sk_sp<SkData> SkPath::serialize() const {
+ size_t size = this->writeToMemory(nullptr);
+ sk_sp<SkData> data = SkData::MakeUninitialized(size);
+ this->writeToMemory(data->writable_data());
+ return data;
+}
+
size_t SkPath::readFromMemory(const void* storage, size_t length) {
SkRBuffer buffer(storage, length);