am a7501119: am 69b8e962: Make Bitmap_createFromParcel check the color count. DO NOT MERGE

* commit 'a7501119e341626536ce12c3539c2f9a986a2945':
  Make Bitmap_createFromParcel check the color count. DO NOT MERGE

1 files changed, 15 insertions, 7 deletions

diff --git a/core/jni/android/graphics/Bitmap.cpp b/core/jni/android/graphics/Bitmap.cpp
index d97a945bbef8..5bdeef21ed60 100644
--- a/core/jni/android/graphics/Bitmap.cpp
+++ b/core/jni/android/graphics/Bitmap.cpp
@@ -505,24 +505,33 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
         return NULL;

     }

 

-    SkBitmap* bitmap = new SkBitmap;

+    SkAutoTDelete<SkBitmap> bitmap(new SkBitmap);

 

-    bitmap->setConfig(config, width, height, rowBytes);

+    if (!bitmap->setConfig(config, width, height, rowBytes)) {

+        return NULL;

+    }

 

     SkColorTable* ctable = NULL;

     if (config == SkBitmap::kIndex8_Config) {

         int count = p->readInt32();

+        if (count < 0 || count > 256) {

+            // The data is corrupt, since SkColorTable enforces a value between 0 and 256,

+            // inclusive.

+            return NULL;

+        }

         if (count > 0) {

             size_t size = count * sizeof(SkPMColor);

             const SkPMColor* src = (const SkPMColor*)p->readInplace(size);

+            if (src == NULL) {

+                return NULL;

+            }

             ctable = new SkColorTable(src, count);

         }

     }

 

-    jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable);

+    jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap.get(), ctable);

     if (NULL == buffer) {

         SkSafeUnref(ctable);

-        delete bitmap;

         return NULL;

     }

 

@@ -534,7 +543,6 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
     android::status_t status = p->readBlob(size, &blob);

     if (status) {

         doThrowRE(env, "Could not read bitmap from parcel blob.");

-        delete bitmap;

         return NULL;

     }

 

@@ -544,8 +552,8 @@ static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {
 

     blob.release();

 

-    return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable),

-            NULL, NULL, density);

+    return GraphicsJNI::createBitmap(env, bitmap.detach(), buffer,

+            getPremulBitmapCreateFlags(isMutable), NULL, NULL, density);

 }

 

 static jboolean Bitmap_writeToParcel(JNIEnv* env, jobject,