Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 69b8e962: Make Bitmap_createFromParcel check the color count. DO NOT MERGE

Browse Source 
* commit '69b8e962e1b8346b33a2c14889547a0ac00c8b17':
  Make Bitmap_createFromParcel check the color count. DO NOT MERGE
This commit is contained in:
Leon Scroggins III
2015-04-23 15:48:12 +00:00
committed by Android Git Automerger
parent 545dd853bf 69b8e962e1
commit a7501119e3
1 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
core/jni/android/graphics/Bitmap.cpp
View File

@@ -488,24 +488,33 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
return NULL; return NULL;
} }
SkBitmap* bitmap = new SkBitmap; SkAutoTDelete<SkBitmap> bitmap(new SkBitmap);
bitmap->setConfig(config, width, height, rowBytes); if (!bitmap->setConfig(config, width, height, rowBytes)) {
return NULL;
}
SkColorTable* ctable = NULL; SkColorTable* ctable = NULL;
if (config == SkBitmap::kIndex8_Config) { if (config == SkBitmap::kIndex8_Config) {
int count = p->readInt32(); int count = p->readInt32();
if (count < 0 || count > 256) {
// The data is corrupt, since SkColorTable enforces a value between 0 and 256,
// inclusive.
return NULL;
}
if (count > 0) { if (count > 0) {
size_t size = count * sizeof(SkPMColor); size_t size = count * sizeof(SkPMColor);
const SkPMColor* src = (const SkPMColor*)p->readInplace(size); const SkPMColor* src = (const SkPMColor*)p->readInplace(size);
if (src == NULL) {
return NULL;
}
ctable = new SkColorTable(src, count); ctable = new SkColorTable(src, count);
} }
} }
jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable); jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap.get(), ctable);
if (NULL == buffer) { if (NULL == buffer) {
SkSafeUnref(ctable); SkSafeUnref(ctable);
delete bitmap;
return NULL; return NULL;
} }
@@ -517,7 +526,6 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
android::status_t status = p->readBlob(size, &blob); android::status_t status = p->readBlob(size, &blob);
if (status) { if (status) {
doThrowRE(env, "Could not read bitmap from parcel blob."); doThrowRE(env, "Could not read bitmap from parcel blob.");
delete bitmap;
return NULL; return NULL;
} }
@@ -527,8 +535,8 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
blob.release(); blob.release();
return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable), return GraphicsJNI::createBitmap(env, bitmap.detach(), buffer,
NULL, NULL, density); getPremulBitmapCreateFlags(isMutable), NULL, NULL, density);
} }
static jboolean Bitmap_writeToParcel(JNIEnv* env, jobject, static jboolean Bitmap_writeToParcel(JNIEnv* env, jobject,