commit | f8aec588bfd2df17130ee93593a8f4ae781afe1f | [log] [tgz] |
---|---|---|
author | ajuma <ajuma@chromium.org> | Wed Jan 13 13:46:31 2016 -0800 |
committer | Commit bot <commit-bot@chromium.org> | Wed Jan 13 13:46:32 2016 -0800 |
tree | 1e351d951aa5cafd57155c59d968f5c4248c8451 | |
parent | 97c40072b0ed5fdca3724ec79dd09d5467a981b5 [diff] [blame] |
Fix fuzzer-found deserialization bugs This fixes deserialization bugs found by fuzzing SkPaintImageFilter. BUG=576908,576910 GOLD_TRYBOT_URL= https://gold.skia.org/search2?unt=true&query=source_type%3Dgm&master=false&issue=1589533002 Review URL: https://codereview.chromium.org/1589533002
diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp index 28bffcb..cf4e8ff 100644 --- a/src/core/SkPathRef.cpp +++ b/src/core/SkPathRef.cpp
@@ -138,8 +138,11 @@ int32_t verbCount, pointCount, conicCount; if (!buffer->readU32(&(ref->fGenerationID)) || !buffer->readS32(&verbCount) || + verbCount < 0 || !buffer->readS32(&pointCount) || - !buffer->readS32(&conicCount)) { + pointCount < 0 || + !buffer->readS32(&conicCount) || + conicCount < 0) { delete ref; return nullptr; }