* commit '303581be5ba3875b0501cb8aa00a0228e22a6cc6': DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes
This commit is contained in:
@@ -212,9 +212,19 @@ static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
|
||||
|
||||
android::Parcel* p = android::parcelForJavaObject(env, parcel);
|
||||
|
||||
SkRegion* region = new SkRegion;
|
||||
size_t size = p->readInt32();
|
||||
region->readFromMemory(p->readInplace(size), size);
|
||||
const void* regionData = p->readInplace(size);
|
||||
if (regionData == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
SkRegion* region = new SkRegion;
|
||||
size_t actualSize = region->readFromMemory(regionData, size);
|
||||
|
||||
if (size != actualSize) {
|
||||
delete region;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return reinterpret_cast<jlong>(region);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user