commit b0ae566b231e6ff89ca6cdba2faa90016857ad88
author Robert Phillips <robertphillips@google.com> Wed Jan 24 14:39:38 2018 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Wed Jan 24 20:14:19 2018 +0000
tree 390006f6d61dfecada83b30a98a7cd9f55b8358d
parent dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef

Check enum values in SkDisplacementMapEffect's CreateProc

Bug: skia:5635
Change-Id: Iaa01d2207916d0e2a2e2623f124b2b4023b51b1b
Reviewed-on: https://skia-review.googlesource.com/99204
Commit-Queue: Robert Phillips <robertphillips@google.com>
Reviewed-by: Mike Reed <reed@google.com>

src/effects/SkDisplacementMapEffect.cpp

diff --git a/src/effects/SkDisplacementMapEffect.cpp b/src/effects/SkDisplacementMapEffect.cpp
index 14a1f66..3fabb4d 100644
--- a/src/effects/SkDisplacementMapEffect.cpp
+++ b/src/effects/SkDisplacementMapEffect.cpp
@@ -11,6 +11,7 @@
 #include "SkColorSpaceXformer.h"
 #include "SkImageFilterPriv.h"
 #include "SkReadBuffer.h"
+#include "SkSafeRange.h"
 #include "SkSpecialImage.h"
 #include "SkWriteBuffer.h"
 #include "SkUnPreMultiply.h"
@@ -146,10 +147,21 @@
 }
 
 sk_sp<SkFlattenable> SkDisplacementMapEffect::CreateProc(SkReadBuffer& buffer) {
+    SkSafeRange safe;
+
     SK_IMAGEFILTER_UNFLATTEN_COMMON(common, 2);
-    ChannelSelectorType xsel = (ChannelSelectorType)buffer.readInt();
-    ChannelSelectorType ysel = (ChannelSelectorType)buffer.readInt();
+
+    ChannelSelectorType xsel = safe.checkLE<ChannelSelectorType>(buffer.readInt(),
+                                                                 kLast_ChannelSelectorType);
+    ChannelSelectorType ysel = safe.checkLE<ChannelSelectorType>(buffer.readInt(),
+                                                                 kLast_ChannelSelectorType);
+
     SkScalar scale = buffer.readScalar();
+
+    if (!buffer.validate(safe)) {
+        return nullptr;
+    }
+
     return Make(xsel, ysel, scale,
                 common.getInput(0), common.getInput(1),
                 &common.cropRect());