commit 8a4e9c51f4ef57f9a1d5d128e778657d96f14e53
author Matt Sarett <msarett@google.com> Tue Oct 25 14:24:50 2016 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Wed Oct 26 00:43:27 2016 +0000
tree ea06fc174c621c8f1c04176b0703ebd46cdafcd1
parent 8bce117ff770f4778f496911b83f953a53907ed4

SkGifCodec: do not write off the end of memory when repeatCount > 1

BUG=skia:5887

GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=3940

Change-Id: I9e3ed6153a73277896ac067ef73918a41a0546b8
Reviewed-on: https://skia-review.googlesource.com/3940
Reviewed-by: Leon Scroggins <scroggo@google.com>
Commit-Queue: Matt Sarett <msarett@google.com>

src/codec/SkGifCodec.cpp

diff --git a/src/codec/SkGifCodec.cpp b/src/codec/SkGifCodec.cpp
index 46a38cd..e7d8afd 100644
--- a/src/codec/SkGifCodec.cpp
+++ b/src/codec/SkGifCodec.cpp
@@ -464,6 +464,10 @@
         if (!foundNecessaryRow) {
             return true;
         }
+    } else {
+        // Make sure the repeatCount does not take us beyond the end of the dst
+        SkASSERT(this->dstInfo().height() >= yBegin);
+        repeatCount = SkTMin(repeatCount, (unsigned) (this->dstInfo().height() - yBegin));
     }
 
     if (!fFilledBackground) {