Harden size check during textblob deserialization
Check the text size read from a buffer should not exceed the size of
the input buffer. This is to avoid memory allocation errors such as
out of memory.
BUG=chromium:809200
Change-Id: I47824f6e8122bd550ee97ac83e2251b7725865e7
Reviewed-on: https://skia-review.googlesource.com/113289
Reviewed-by: Florin Malita <fmalita@chromium.org>
Commit-Queue: Florin Malita <fmalita@chromium.org>
diff --git a/src/core/SkTextBlob.cpp b/src/core/SkTextBlob.cpp
index f686f29..182cf72 100644
--- a/src/core/SkTextBlob.cpp
+++ b/src/core/SkTextBlob.cpp
@@ -809,7 +809,7 @@
return nullptr;
}
int textSize = pe.extended ? reader.read32() : 0;
- if (textSize < 0) {
+ if (textSize < 0 || static_cast<size_t>(textSize) > reader.size()) {
return nullptr;
}