Check that the parcel contained the expected amount of region data.

bug:20883006
Change-Id: Ib47a8ec8696dbc37e958b8dbceb43fcbabf6605b
This commit is contained in:
Derek Sollenberger
2015-05-18 14:29:02 -04:00
parent beda8613ad
commit cdadfc211d

View File

@@ -212,10 +212,14 @@ static jlong Region_createFromParcel(JNIEnv* env, jobject clazz, jobject parcel)
android::Parcel* p = android::parcelForJavaObject(env, parcel);
SkRegion* region = new SkRegion;
size_t size = p->readInt32();
size_t actualSize = region->readFromMemory(p->readInplace(size), size);
const size_t size = p->readInt32();
const void* regionData = p->readInplace(size);
if (regionData == nullptr) {
return 0;
}
SkRegion* region = new SkRegion;
size_t actualSize = region->readFromMemory(regionData, size);
if (size != actualSize) {
delete region;
return 0;