commit c31bb870f274455197749cceea48c45c4b905d6e
author robertphillips <robertphillips@google.com> Tue Jun 28 11:02:30 2016 -0700
committer Commit bot <commit-bot@chromium.org> Tue Jun 28 11:02:30 2016 -0700
tree aef9697850c352b0b428d2d38a50a650230eb88c
parent d9114cb8f37cc106b07bb50fc736ede394d88dae

Tighten up masking of colorType & alphaType in SkImageInfo serialization (for fuzzer bug)

In this case the int that contains the color and alpha types is getting munged. We don't really case that the surplus bits are 0 just that the values we care about are reasonable.

GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2110493002

Review-Url: https://codereview.chromium.org/2110493002

src/core/SkImageInfo.cpp

diff --git a/src/core/SkImageInfo.cpp b/src/core/SkImageInfo.cpp
index b3b9c38..75c6807 100644
--- a/src/core/SkImageInfo.cpp
+++ b/src/core/SkImageInfo.cpp
@@ -22,14 +22,16 @@
                        SkColorSpace::NewNamed(SkColorSpace::kSRGB_Named));
 }
 
+static const int kColorTypeMask = 0x0F;
+static const int kAlphaTypeMask = 0x03;
+
 void SkImageInfo::unflatten(SkReadBuffer& buffer) {
     fWidth = buffer.read32();
     fHeight = buffer.read32();
 
     uint32_t packed = buffer.read32();
-    SkASSERT(0 == (packed >> 24));
-    fColorType = (SkColorType)((packed >> 0) & 0xFF);
-    fAlphaType = (SkAlphaType)((packed >> 8) & 0xFF);
+    fColorType = (SkColorType)((packed >> 0) & kColorTypeMask);
+    fAlphaType = (SkAlphaType)((packed >> 8) & kAlphaTypeMask);
     buffer.validate(alpha_type_is_valid(fAlphaType) && color_type_is_valid(fColorType));
 
     sk_sp<SkData> data = buffer.readByteArrayAsData();
@@ -40,8 +42,8 @@
     buffer.write32(fWidth);
     buffer.write32(fHeight);
 
-    SkASSERT(0 == (fAlphaType & ~0xFF));
-    SkASSERT(0 == (fColorType & ~0xFF));
+    SkASSERT(0 == (fAlphaType & ~kAlphaTypeMask));
+    SkASSERT(0 == (fColorType & ~kColorTypeMask));
     uint32_t packed = (fAlphaType << 8) | fColorType;
     buffer.write32(packed);