Adding more validation
- Added a way to check that the number of inputs of a filter is not more than a filter expects
- Added validation of reftype in SkBitmap::unflatten()
- Added validation on fKD (diffuse lighting constant) and fKS (specular lighting constant) to make sure that they are always non-negative numbers
- Added validation of SkPerlinNoiseShader::fType and SkPerlinNoiseShader::fNumOctaves
BUG=
R=reed@google.com, senorblanco@google.com, mtklein@google.com, senorblanco@chromium.org, sugoi@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/83343003
git-svn-id: http://skia.googlecode.com/svn/trunk@12388 2bbb7eff-a529-9590-31e7-b0007b416f81
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index 2fae75a..429d092 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1622,19 +1622,21 @@
this->setConfig(config, width, height, rowBytes, alphaType);
int reftype = buffer.readInt();
- switch (reftype) {
- case SERIALIZE_PIXELTYPE_REF_DATA: {
- size_t offset = buffer.readUInt();
- SkPixelRef* pr = buffer.readPixelRef();
- SkSafeUnref(this->setPixelRef(pr, offset));
- break;
+ if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||
+ (SERIALIZE_PIXELTYPE_NONE == reftype))) {
+ switch (reftype) {
+ case SERIALIZE_PIXELTYPE_REF_DATA: {
+ size_t offset = buffer.readUInt();
+ SkPixelRef* pr = buffer.readPixelRef();
+ SkSafeUnref(this->setPixelRef(pr, offset));
+ break;
+ }
+ case SERIALIZE_PIXELTYPE_NONE:
+ break;
+ default:
+ SkDEBUGFAIL("unrecognized pixeltype in serialized data");
+ sk_throw();
}
- case SERIALIZE_PIXELTYPE_NONE:
- break;
- default:
- buffer.validate(false);
- SkDEBUGFAIL("unrecognized pixeltype in serialized data");
- sk_throw();
}
}
diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
index 9bf3925..cca22bb 100644
--- a/src/core/SkImageFilter.cpp
+++ b/src/core/SkImageFilter.cpp
@@ -53,20 +53,27 @@
delete[] fInputs;
}
-SkImageFilter::SkImageFilter(SkFlattenableReadBuffer& buffer)
- : fInputCount(buffer.readInt()), fInputs(new SkImageFilter*[fInputCount]) {
- for (int i = 0; i < fInputCount; i++) {
- if (buffer.readBool()) {
- fInputs[i] = buffer.readImageFilter();
- } else {
- fInputs[i] = NULL;
+SkImageFilter::SkImageFilter(int maxInputCount, SkFlattenableReadBuffer& buffer) {
+ fInputCount = buffer.readInt();
+ if (buffer.validate((fInputCount >= 0) && (fInputCount <= maxInputCount))) {
+ fInputs = new SkImageFilter*[fInputCount];
+ for (int i = 0; i < fInputCount; i++) {
+ if (buffer.readBool()) {
+ fInputs[i] = buffer.readImageFilter();
+ } else {
+ fInputs[i] = NULL;
+ }
}
+ SkRect rect;
+ buffer.readRect(&rect);
+ if (buffer.validate(SkIsValidRect(rect))) {
+ uint32_t flags = buffer.readUInt();
+ fCropRect = CropRect(rect, flags);
+ }
+ } else {
+ fInputCount = 0;
+ fInputs = NULL;
}
- SkRect rect;
- buffer.readRect(&rect);
- uint32_t flags = buffer.readUInt();
- fCropRect = CropRect(rect, flags);
- buffer.validate(SkIsValidRect(rect));
}
void SkImageFilter::flatten(SkFlattenableWriteBuffer& buffer) const {