Revert "Avoid integer overflow in SkIcoCodec"
authorMatt Sarett <msarett@google.com>
Mon, 17 Oct 2016 17:43:23 +0000 (17:43 +0000)
committerMatt Sarett <msarett@google.com>
Mon, 17 Oct 2016 17:43:32 +0000 (17:43 +0000)
This reverts commit 20cba06a4bc9bde60b2dc37907d11ca81ba35ce8.

Reason for revert: <INSERT REASONING HERE>

TBR=msarett@google.com,scroggo@google.com,kjlubick@google.com,reviews@skia.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: Id8f48a90a7dc620f9c0ee2f419d14bae2b0c1e7e
Reviewed-on: https://skia-review.googlesource.com/3564
Commit-Queue: Matt Sarett <msarett@google.com>
Reviewed-by: Matt Sarett <msarett@google.com>
resources/invalid_images/int_overflow.ico [deleted file]
src/codec/SkIcoCodec.cpp
tests/CodecTest.cpp

diff --git a/resources/invalid_images/int_overflow.ico b/resources/invalid_images/int_overflow.ico
deleted file mode 100644 (file)
index 24a7c70..0000000
Binary files a/resources/invalid_images/int_overflow.ico and /dev/null differ
index d01904d..63b72c4 100644 (file)
@@ -157,12 +157,11 @@ SkCodec* SkIcoCodec::NewFromStream(SkStream* stream) {
     }
 
     // Use the largest codec as a "suggestion" for image info
-    size_t maxSize = 0;
-    int maxIndex = 0;
-    for (int i = 0; i < codecs->count(); i++) {
+    uint32_t maxSize = 0;
+    uint32_t maxIndex = 0;
+    for (int32_t i = 0; i < codecs->count(); i++) {
         SkImageInfo info = codecs->operator[](i)->getInfo();
-        size_t size = info.getSafeSize(info.minRowBytes());
-
+        uint32_t size = info.width() * info.height();
         if (size > maxSize) {
             maxSize = size;
             maxIndex = i;
index a6058a9..4d18c61 100644 (file)
@@ -1362,10 +1362,3 @@ DEF_TEST(Codec_rowsDecoded, r) {
     REPORTER_ASSERT(r, result == SkCodec::kIncompleteInput);
     REPORTER_ASSERT(r, rowsDecoded == 0);
 }
-
-DEF_TEST(Codec_IcoIntOverflow, r) {
-    // ASAN will complain if there is an issue.
-    SkBitmap bitmap;
-    const bool success = GetResourceAsBitmap("invalid_images/int_overflow.ico", &bitmap);
-    REPORTER_ASSERT(r, !success);
-}