Commit c14c84f5 authored by Khushal's avatar Khushal Committed by Commit Bot

cc: Add some validation checks for row_bytes during image deserialization.

TBR=ericrk@chromium.org

Bug: 1041477,1045751,1045723,1045710
Change-Id: I5bf2d39e5b40f419072c4df986c2e85c4375ecff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2021888Reviewed-by: default avatarKhushal <khushalsagar@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Auto-Submit: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#735257}
parent b0c80c83
......@@ -500,8 +500,10 @@ bool ServiceImageTransferCacheEntry::Deserialize(
SkImageInfo image_info = SkImageInfo::Make(
width, height, color_type, kPremul_SkAlphaType, pixmap_color_space);
if (image_info.computeMinByteSize() > pixel_size)
if (row_bytes < image_info.minRowBytes() ||
image_info.computeByteSize(row_bytes) > pixel_size) {
return false;
}
// Align data to a 4-byte boundry, to match what we did when writing.
reader.AlignMemory(4);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment