Commit 8f74e81d authored by Adrienne Walker's avatar Adrienne Walker Committed by Commit Bot

cc: fix fuzzing issue with paint op buffer of size 2

If an op contians a paint op buffer of size 2, then this code will fail.
All ops are at least size 4, so safely early out when this is not true.

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ia44fa235f1e8fbae923b0ebf407bc6f0bc0a4cbe
Reviewed-on: https://chromium-review.googlesource.com/1205533Reviewed-by: default avatarKhushal <khushalsagar@chromium.org>
Commit-Queue: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#588915}
parent 8d9f363e
......@@ -82,6 +82,8 @@ bool PaintOpReader::ReadAndValidateOpHeader(const volatile void* input,
size_t input_size,
uint8_t* type,
uint32_t* skip) {
if (input_size < 4)
return false;
uint32_t first_word = reinterpret_cast<const volatile uint32_t*>(input)[0];
*type = static_cast<uint8_t>(first_word & 0xFF);
*skip = first_word >> 8;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment