Security fixes re getSize().

git-svn-id: http://skia.googlecode.com/svn/trunk@646 2bbb7eff-a529-9590-31e7-b0007b416f81

diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index e706326..8266dfe 100644 (file)
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -840,7 +840,7 @@ bool SkBitmap::copyTo(SkBitmap* dst, Config dstConfig, Allocator* alloc) const {
     */
     if (this->config() == dstConfig) {
         if (tmp.getSize() == this->getSize()) {
-            memcpy(tmp.getPixels(), this->getPixels(), this->getSize());
+            memcpy(tmp.getPixels(), this->getPixels(), this->getSafeSize());
         } else {
             const char* srcP = reinterpret_cast<const char*>(this->getPixels());
             char* dstP = reinterpret_cast<char*>(tmp.getPixels());
@@ -1362,10 +1362,11 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
             }
             if (this->allocPixels(ctable)) {
                 this->lockPixels();
-                buffer.read(this->getPixels(), size);
+                buffer.read(this->getPixels(), this->getSafeSize()); // Just read what we need.
+                buffer.skip(size - this->getSafeSize()); // Keep aligned for subsequent reads.
                 this->unlockPixels();
             } else {
-                buffer.skip(size);
+                buffer.skip(size); // Still skip the full-sized buffer though.
             }
             SkSafeUnref(ctable);
             break;

diff --git a/src/gl/SkGL.cpp b/src/gl/SkGL.cpp
index 1fce98f..fa1e50b 100644 (file)
--- a/src/gl/SkGL.cpp
+++ b/src/gl/SkGL.cpp
@@ -222,7 +222,7 @@ static void build_compressed_data(void* buffer, const SkBitmap& bitmap) {
 
     // always skip a full 256 number of entries, even if we memcpy'd fewer
     dst += SK_GL_SIZE_OF_PALETTE;
-    memcpy(dst, bitmap.getPixels(), bitmap.getSize());
+    memcpy(dst, bitmap.getPixels(), bitmap.getSafeSize()); // Just copy what we need.
 }
 #endif
 

diff --git a/src/utils/win/SkOSWindow_Win.cpp b/src/utils/win/SkOSWindow_Win.cpp
index 26993be..d278871 100644 (file)
--- a/src/utils/win/SkOSWindow_Win.cpp
+++ b/src/utils/win/SkOSWindow_Win.cpp
@@ -149,6 +149,7 @@ void SkOSWindow::doPaint(void* ctx) {
            // 
            // Do the SetDIBitsToDevice. 
            // 
+           SkASSERT(bitmap.width() * bitmap.bytesPerPixel() == bitmap.rowBytes());
            bitmap.lockPixels();
            int iRet = SetDIBitsToDevice(hdc,
                    0, 0,
@@ -566,4 +567,433 @@ void SkOSWindow::presentD3D9() {
 }
 
 
-#endif
\ No newline at end of file
+#endif
+||||||| merged common ancestors
+#include "SkTypes.h"\r
+\r
+#if defined(SK_BUILD_FOR_WIN)\r
+\r
+#include "SkWindow.h"\r
+#include "SkCanvas.h"\r
+#include "SkOSMenu.h"\r
+#include "SkTime.h"\r
+\r
+#include "SkGraphics.h"\r
+\r
+static SkOSWindow* gCurrOSWin;\r
+\r
+SkOSWindow::SkOSWindow(void* hWnd) : fHWND(hWnd) {\r
+}\r
+\r
+static SkKey winToskKey(WPARAM vk) {\r
+       static const struct {\r
+               WPARAM  fVK;\r
+               SkKey   fKey;\r
+       } gPair[] = {\r
+               { VK_BACK,      kBack_SkKey },\r
+               { VK_CLEAR,     kBack_SkKey },\r
+               { VK_RETURN, kOK_SkKey },\r
+               { VK_UP,         kUp_SkKey },\r
+               { VK_DOWN,       kDown_SkKey },\r
+               { VK_LEFT,       kLeft_SkKey },\r
+               { VK_RIGHT,      kRight_SkKey }\r
+       };\r
+       for (size_t i = 0; i < SK_ARRAY_COUNT(gPair); i++) {\r
+               if (gPair[i].fVK == vk) {\r
+                       return gPair[i].fKey;\r
+               }\r
+       }\r
+       return kNONE_SkKey;\r
+}\r
+\r
+bool SkOSWindow::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) {\r
+       switch (message) {\r
+               case WM_KEYDOWN: {\r
+                       SkKey key = winToskKey(wParam);\r
+                       if (kNONE_SkKey != key) {\r
+                               this->handleKey(key);\r
+                               return true;\r
+                       }\r
+               } break;\r
+               case WM_KEYUP: {\r
+                       SkKey key = winToskKey(wParam);\r
+                       if (kNONE_SkKey != key) {\r
+                               this->handleKeyUp(key);\r
+                               return true;\r
+                       }\r
+               } break;\r
+               case WM_UNICHAR:\r
+                       this->handleChar(lParam);\r
+                       return true;\r
+               case WM_SIZE:\r
+                       this->resize(lParam & 0xFFFF, lParam >> 16);\r
+                       break;\r
+               case WM_PAINT: {\r
+                       PAINTSTRUCT ps;\r
+                       HDC hdc = BeginPaint(hWnd, &ps);\r
+                       this->doPaint(hdc);\r
+                       EndPaint(hWnd, &ps);\r
+                       return true;\r
+               } break;\r
+       }\r
+       return false;\r
+}\r
+\r
+void SkOSWindow::doPaint(void* ctx) {\r
+       this->update(NULL);\r
+\r
+       HDC hdc = (HDC)ctx;\r
+    const SkBitmap& bitmap = this->getBitmap();\r
+\r
+       BITMAPINFO bmi;\r
+       memset(&bmi, 0, sizeof(bmi));\r
+       bmi.bmiHeader.biSize        = sizeof(BITMAPINFOHEADER);\r
+       bmi.bmiHeader.biWidth       = bitmap.width();\r
+       bmi.bmiHeader.biHeight      = -bitmap.height(); // top-down image \r
+       bmi.bmiHeader.biPlanes      = 1;\r
+       bmi.bmiHeader.biBitCount    = 32;\r
+       bmi.bmiHeader.biCompression = BI_RGB;\r
+       bmi.bmiHeader.biSizeImage   = 0;\r
+\r
+       // \r
+       // Do the SetDIBitsToDevice. \r
+       // \r
+       bitmap.lockPixels();\r
+       int iRet = SetDIBitsToDevice(hdc,\r
+               0, 0,\r
+               bitmap.width(), bitmap.height(),\r
+               0, 0,\r
+               0, bitmap.height(),\r
+               bitmap.getPixels(),\r
+               &bmi,\r
+               DIB_RGB_COLORS);\r
+       bitmap.unlockPixels();\r
+}\r
+\r
+#if 0\r
+void SkOSWindow::updateSize()\r
+{\r
+       RECT    r;\r
+       GetWindowRect((HWND)this->getHWND(), &r);\r
+       this->resize(r.right - r.left, r.bottom - r.top);\r
+}\r
+#endif\r
+\r
+void SkOSWindow::onHandleInval(const SkIRect& r) {\r
+       RECT rect;\r
+       rect.left = r.fLeft;\r
+       rect.top = r.fTop;\r
+       rect.right = r.fRight;\r
+       rect.bottom = r.fBottom;\r
+       InvalidateRect((HWND)this->getHWND(), &rect, false);\r
+}\r
+\r
+void SkOSWindow::onAddMenu(const SkOSMenu* sk_menu)\r
+{\r
+}\r
+\r
+\r
+enum {\r
+       SK_MacReturnKey         = 36,\r
+       SK_MacDeleteKey         = 51,\r
+       SK_MacEndKey            = 119,\r
+       SK_MacLeftKey           = 123,\r
+       SK_MacRightKey          = 124,\r
+       SK_MacDownKey           = 125,\r
+       SK_MacUpKey                     = 126,\r
+    \r
+    SK_Mac0Key          = 0x52,\r
+    SK_Mac1Key          = 0x53,\r
+    SK_Mac2Key          = 0x54,\r
+    SK_Mac3Key          = 0x55,\r
+    SK_Mac4Key          = 0x56,\r
+    SK_Mac5Key          = 0x57,\r
+    SK_Mac6Key          = 0x58,\r
+    SK_Mac7Key          = 0x59,\r
+    SK_Mac8Key          = 0x5b,\r
+    SK_Mac9Key          = 0x5c\r
+};\r
+       \r
+static SkKey raw2key(uint32_t raw)\r
+{\r
+       static const struct {\r
+               uint32_t  fRaw;\r
+               SkKey   fKey;\r
+       } gKeys[] = {\r
+               { SK_MacUpKey,          kUp_SkKey               },\r
+               { SK_MacDownKey,        kDown_SkKey             },\r
+               { SK_MacLeftKey,        kLeft_SkKey             },\r
+               { SK_MacRightKey,   kRight_SkKey        },\r
+               { SK_MacReturnKey,  kOK_SkKey           },\r
+               { SK_MacDeleteKey,  kBack_SkKey         },\r
+               { SK_MacEndKey,         kEnd_SkKey              },\r
+        { SK_Mac0Key,       k0_SkKey        },\r
+        { SK_Mac1Key,       k1_SkKey        },\r
+        { SK_Mac2Key,       k2_SkKey        },\r
+        { SK_Mac3Key,       k3_SkKey        },\r
+        { SK_Mac4Key,       k4_SkKey        },\r
+        { SK_Mac5Key,       k5_SkKey        },\r
+        { SK_Mac6Key,       k6_SkKey        },\r
+        { SK_Mac7Key,       k7_SkKey        },\r
+        { SK_Mac8Key,       k8_SkKey        },\r
+        { SK_Mac9Key,       k9_SkKey        }\r
+       };\r
+       \r
+       for (unsigned i = 0; i < SK_ARRAY_COUNT(gKeys); i++)\r
+               if (gKeys[i].fRaw == raw)\r
+                       return gKeys[i].fKey;\r
+       return kNONE_SkKey;\r
+}\r
+\r
+///////////////////////////////////////////////////////////////////////////////////////\r
+\r
+void SkEvent::SignalNonEmptyQueue()\r
+{\r
+//     post_skmacevent();\r
+//     SkDebugf("signal nonempty\n");\r
+}\r
+\r
+//static void sk_timer_proc(TMTask* rec)\r
+//{\r
+//     SkEvent::ServiceQueueTimer();\r
+//     SkDebugf("timer task fired\n");\r
+//}\r
+\r
+void SkEvent::SignalQueueTimer(SkMSec delay)\r
+{\r
+#if 0\r
+       if (gTMTaskPtr)\r
+       {\r
+               RemoveTimeTask((QElem*)gTMTaskPtr);\r
+               DisposeTimerUPP(gTMTaskPtr->tmAddr);\r
+               gTMTaskPtr = nil;\r
+       }\r
+       if (delay)\r
+       {\r
+               gTMTaskPtr = &gTMTaskRec;\r
+               memset(gTMTaskPtr, 0, sizeof(gTMTaskRec));\r
+               gTMTaskPtr->tmAddr = NewTimerUPP(sk_timer_proc);\r
+               OSErr err = InstallTimeTask((QElem*)gTMTaskPtr);\r
+//             SkDebugf("installtimetask of %d returned %d\n", delay, err);\r
+               PrimeTimeTask((QElem*)gTMTaskPtr, delay);\r
+       }\r
+#endif\r
+}\r
+\r
+#endif\r
+\r
+=======
+#include "SkTypes.h"\r
+\r
+#if defined(SK_BUILD_FOR_WIN)\r
+\r
+#include "SkWindow.h"\r
+#include "SkCanvas.h"\r
+#include "SkOSMenu.h"\r
+#include "SkTime.h"\r
+\r
+#include "SkGraphics.h"\r
+\r
+static SkOSWindow* gCurrOSWin;\r
+\r
+SkOSWindow::SkOSWindow(void* hWnd) : fHWND(hWnd) {\r
+}\r
+\r
+static SkKey winToskKey(WPARAM vk) {\r
+       static const struct {\r
+               WPARAM  fVK;\r
+               SkKey   fKey;\r
+       } gPair[] = {\r
+               { VK_BACK,      kBack_SkKey },\r
+               { VK_CLEAR,     kBack_SkKey },\r
+               { VK_RETURN, kOK_SkKey },\r
+               { VK_UP,         kUp_SkKey },\r
+               { VK_DOWN,       kDown_SkKey },\r
+               { VK_LEFT,       kLeft_SkKey },\r
+               { VK_RIGHT,      kRight_SkKey }\r
+       };\r
+       for (size_t i = 0; i < SK_ARRAY_COUNT(gPair); i++) {\r
+               if (gPair[i].fVK == vk) {\r
+                       return gPair[i].fKey;\r
+               }\r
+       }\r
+       return kNONE_SkKey;\r
+}\r
+\r
+bool SkOSWindow::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) {\r
+       switch (message) {\r
+               case WM_KEYDOWN: {\r
+                       SkKey key = winToskKey(wParam);\r
+                       if (kNONE_SkKey != key) {\r
+                               this->handleKey(key);\r
+                               return true;\r
+                       }\r
+               } break;\r
+               case WM_KEYUP: {\r
+                       SkKey key = winToskKey(wParam);\r
+                       if (kNONE_SkKey != key) {\r
+                               this->handleKeyUp(key);\r
+                               return true;\r
+                       }\r
+               } break;\r
+               case WM_UNICHAR:\r
+                       this->handleChar(lParam);\r
+                       return true;\r
+               case WM_SIZE:\r
+                       this->resize(lParam & 0xFFFF, lParam >> 16);\r
+                       break;\r
+               case WM_PAINT: {\r
+                       PAINTSTRUCT ps;\r
+                       HDC hdc = BeginPaint(hWnd, &ps);\r
+                       this->doPaint(hdc);\r
+                       EndPaint(hWnd, &ps);\r
+                       return true;\r
+               } break;\r
+       }\r
+       return false;\r
+}\r
+\r
+void SkOSWindow::doPaint(void* ctx) {\r
+       this->update(NULL);\r
+\r
+       HDC hdc = (HDC)ctx;\r
+    const SkBitmap& bitmap = this->getBitmap();\r
+\r
+       BITMAPINFO bmi;\r
+       memset(&bmi, 0, sizeof(bmi));\r
+       bmi.bmiHeader.biSize        = sizeof(BITMAPINFOHEADER);\r
+       bmi.bmiHeader.biWidth       = bitmap.width();\r
+       bmi.bmiHeader.biHeight      = -bitmap.height(); // top-down image \r
+       bmi.bmiHeader.biPlanes      = 1;\r
+       bmi.bmiHeader.biBitCount    = 32;\r
+       bmi.bmiHeader.biCompression = BI_RGB;\r
+       bmi.bmiHeader.biSizeImage   = 0;\r
+\r
+       // \r
+       // Do the SetDIBitsToDevice. \r
+       // \r
+    SkASSERT(bitmap.width() * bitmap.bytesPerPixel() == bitmap.rowBytes());\r
+       bitmap.lockPixels();\r
+       int iRet = SetDIBitsToDevice(hdc,\r
+               0, 0,\r
+               bitmap.width(), bitmap.height(),\r
+               0, 0,\r
+               0, bitmap.height(),\r
+               bitmap.getPixels(),\r
+               &bmi,\r
+               DIB_RGB_COLORS);\r
+       bitmap.unlockPixels();\r
+}\r
+\r
+#if 0\r
+void SkOSWindow::updateSize()\r
+{\r
+       RECT    r;\r
+       GetWindowRect((HWND)this->getHWND(), &r);\r
+       this->resize(r.right - r.left, r.bottom - r.top);\r
+}\r
+#endif\r
+\r
+void SkOSWindow::onHandleInval(const SkIRect& r) {\r
+       RECT rect;\r
+       rect.left = r.fLeft;\r
+       rect.top = r.fTop;\r
+       rect.right = r.fRight;\r
+       rect.bottom = r.fBottom;\r
+       InvalidateRect((HWND)this->getHWND(), &rect, false);\r
+}\r
+\r
+void SkOSWindow::onAddMenu(const SkOSMenu* sk_menu)\r
+{\r
+}\r
+\r
+\r
+enum {\r
+       SK_MacReturnKey         = 36,\r
+       SK_MacDeleteKey         = 51,\r
+       SK_MacEndKey            = 119,\r
+       SK_MacLeftKey           = 123,\r
+       SK_MacRightKey          = 124,\r
+       SK_MacDownKey           = 125,\r
+       SK_MacUpKey                     = 126,\r
+    \r
+    SK_Mac0Key          = 0x52,\r
+    SK_Mac1Key          = 0x53,\r
+    SK_Mac2Key          = 0x54,\r
+    SK_Mac3Key          = 0x55,\r
+    SK_Mac4Key          = 0x56,\r
+    SK_Mac5Key          = 0x57,\r
+    SK_Mac6Key          = 0x58,\r
+    SK_Mac7Key          = 0x59,\r
+    SK_Mac8Key          = 0x5b,\r
+    SK_Mac9Key          = 0x5c\r
+};\r
+       \r
+static SkKey raw2key(uint32_t raw)\r
+{\r
+       static const struct {\r
+               uint32_t  fRaw;\r
+               SkKey   fKey;\r
+       } gKeys[] = {\r
+               { SK_MacUpKey,          kUp_SkKey               },\r
+               { SK_MacDownKey,        kDown_SkKey             },\r
+               { SK_MacLeftKey,        kLeft_SkKey             },\r
+               { SK_MacRightKey,   kRight_SkKey        },\r
+               { SK_MacReturnKey,  kOK_SkKey           },\r
+               { SK_MacDeleteKey,  kBack_SkKey         },\r
+               { SK_MacEndKey,         kEnd_SkKey              },\r
+        { SK_Mac0Key,       k0_SkKey        },\r
+        { SK_Mac1Key,       k1_SkKey        },\r
+        { SK_Mac2Key,       k2_SkKey        },\r
+        { SK_Mac3Key,       k3_SkKey        },\r
+        { SK_Mac4Key,       k4_SkKey        },\r
+        { SK_Mac5Key,       k5_SkKey        },\r
+        { SK_Mac6Key,       k6_SkKey        },\r
+        { SK_Mac7Key,       k7_SkKey        },\r
+        { SK_Mac8Key,       k8_SkKey        },\r
+        { SK_Mac9Key,       k9_SkKey        }\r
+       };\r
+       \r
+       for (unsigned i = 0; i < SK_ARRAY_COUNT(gKeys); i++)\r
+               if (gKeys[i].fRaw == raw)\r
+                       return gKeys[i].fKey;\r
+       return kNONE_SkKey;\r
+}\r
+\r
+///////////////////////////////////////////////////////////////////////////////////////\r
+\r
+void SkEvent::SignalNonEmptyQueue()\r
+{\r
+//     post_skmacevent();\r
+//     SkDebugf("signal nonempty\n");\r
+}\r
+\r
+//static void sk_timer_proc(TMTask* rec)\r
+//{\r
+//     SkEvent::ServiceQueueTimer();\r
+//     SkDebugf("timer task fired\n");\r
+//}\r
+\r
+void SkEvent::SignalQueueTimer(SkMSec delay)\r
+{\r
+#if 0\r
+       if (gTMTaskPtr)\r
+       {\r
+               RemoveTimeTask((QElem*)gTMTaskPtr);\r
+               DisposeTimerUPP(gTMTaskPtr->tmAddr);\r
+               gTMTaskPtr = nil;\r
+       }\r
+       if (delay)\r
+       {\r
+               gTMTaskPtr = &gTMTaskRec;\r
+               memset(gTMTaskPtr, 0, sizeof(gTMTaskRec));\r
+               gTMTaskPtr->tmAddr = NewTimerUPP(sk_timer_proc);\r
+               OSErr err = InstallTimeTask((QElem*)gTMTaskPtr);\r
+//             SkDebugf("installtimetask of %d returned %d\n", delay, err);\r
+               PrimeTimeTask((QElem*)gTMTaskPtr, delay);\r
+       }\r
+#endif\r
+}\r
+\r
+#endif\r
+\r