| commit | df6660f64e4d915de7471c3daa67f9b68037ff3f | [log] [tgz] |
|---|---|---|
| author | Adrienne Walker <enne@chromium.org> | Wed Jul 26 10:20:10 2017 -0700 |
| committer | Skia Commit-Bot <skia-commit-bot@chromium.org> | Wed Jul 26 17:49:09 2017 +0000 |
| tree | 07b353c21203145e2033837fa0d2574238ce8326 | |
| parent | fcc527b2c9f97a42a94b4236d5c2b4b1e43b38c2 [diff] |
Fix SkPathRef deserialization malloc crash If the path says it has more points/verbs/etc than the buffer could be holding, then resetToSize could try to allocate something huge and crash. Change-Id: I40e8db87e4f61abb23217281ab0365c6af222fa3 Reviewed-on: https://skia-review.googlesource.com/24802 Reviewed-by: Mike Reed <reed@google.com> Commit-Queue: Mike Reed <reed@google.com>