Added count validation in SkImageFilter::Common::unflatten()

BUG=395641
R=reed@google.com, senorblanco@google.com, senorblanco@chromium.org

Author: sugoi@chromium.org

Review URL: https://codereview.chromium.org/405983006

diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
index 3eb688e..11a1420 100644 (file)
--- a/src/core/SkImageFilter.cpp
+++ b/src/core/SkImageFilter.cpp
@@ -44,7 +44,7 @@ bool SkImageFilter::Common::unflatten(SkReadBuffer& buffer, int expectedCount) {
     if (expectedCount < 0) {    // means the caller doesn't care how many
         expectedCount = count;
     }
-    if (!buffer.validate(count == expectedCount)) {
+    if (!buffer.validate((count == expectedCount) && (count >= 0))) {
         return false;
     }