commit ab8e02a4dee79fc4300c5eec0fbbc44d07f433d3
author Hal Canary <halcanary@google.com> Mon Feb 27 09:59:39 2017 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Mon Feb 27 15:39:04 2017 +0000
tree f30cb8b1b73ff87068548d1cf8d1ab2702120edc
parent cb79393e88ecfe2cc21d0f6c3bbea0436b0bacb7

SkGradientShader: Fix multi-byte-read-stack-use-after-scope

BUG=chromium:694098
Change-Id: I9dfd61d1eed123fce33acf55f6f68e80ac41da25
Reviewed-on: https://skia-review.googlesource.com/8985
Reviewed-by: Leon Scroggins <scroggo@google.com>
Commit-Queue: Hal Canary <halcanary@google.com>

src/effects/gradients/SkGradientShader.cpp

diff --git a/src/effects/gradients/SkGradientShader.cpp b/src/effects/gradients/SkGradientShader.cpp
index adb9496..32189c5 100644
--- a/src/effects/gradients/SkGradientShader.cpp
+++ b/src/effects/gradients/SkGradientShader.cpp
@@ -763,9 +763,11 @@
         if (info->fColorCount >= fColorCount) {
             SkColor* colorLoc;
             Rec*     recLoc;
+            SkAutoSTArray<8, SkColor> colorStorage;
+            SkAutoSTArray<8, Rec> recStorage;
             if (flipGrad && (info->fColors || info->fColorOffsets)) {
-                SkAutoSTArray<8, SkColor> colorStorage(fColorCount);
-                SkAutoSTArray<8, Rec> recStorage(fColorCount);
+                colorStorage.reset(fColorCount);
+                recStorage.reset(fColorCount);
                 colorLoc = colorStorage.get();
                 recLoc = recStorage.get();
                 FlipGradientColors(colorLoc, recLoc, fOrigColors, fRecs, fColorCount);