From 462dd010467fdf1ab0cb49e021a92d14f2163c8c Mon Sep 17 00:00:00 2001 From: Leon Scroggins III Date: Thu, 21 May 2015 09:48:15 -0400 Subject: [PATCH] Fix overflow in NinePatchImpl. Cast numXDivs to a size_t before adding 1, so that if numXDivs is 255 it does not overflow. Move the calculation outside of alloca(). BUG:20727488 Change-Id: I2ecc9d650338acba7316554cb72195e02816b1f8 --- core/jni/android/graphics/NinePatchImpl.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/jni/android/graphics/NinePatchImpl.cpp b/core/jni/android/graphics/NinePatchImpl.cpp index 323f832df84d6..978c4a5a8d25f 100644 --- a/core/jni/android/graphics/NinePatchImpl.cpp +++ b/core/jni/android/graphics/NinePatchImpl.cpp @@ -180,7 +180,10 @@ void NinePatch_Draw(SkCanvas* canvas, const SkRect& bounds, const int bitmapWidth = bitmap.width(); const int bitmapHeight = bitmap.height(); - SkScalar* dstRights = (SkScalar*) alloca((numXDivs + 1) * sizeof(SkScalar)); + // Number of bytes needed for dstRights array. + // Need to cast numXDivs to a larger type to avoid overflow. + const size_t dstBytes = ((size_t) numXDivs + 1) * sizeof(SkScalar); + SkScalar* dstRights = (SkScalar*) alloca(dstBytes); bool dstRightsHaveBeenCached = false; int numStretchyXPixelsRemaining = 0;