return false;
}
- FailImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {}
+ FailImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {}
private:
typedef SkImageFilter INHERITED;
return true;
}
- IdentityImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {}
+ IdentityImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {}
private:
typedef SkImageFilter INHERITED;
protected:
explicit SimpleOffsetFilter(SkFlattenableReadBuffer& buffer)
- : SkImageFilter(buffer) {
+ : SkImageFilter(1, buffer) {
fDX = buffer.readScalar();
fDY = buffer.readScalar();
}
virtual ~SkImageFilter();
- explicit SkImageFilter(SkFlattenableReadBuffer& rb);
+ explicit SkImageFilter(int maxInputCount, SkFlattenableReadBuffer& rb);
virtual void flatten(SkFlattenableWriteBuffer& wb) const SK_OVERRIDE;
this->setConfig(config, width, height, rowBytes, alphaType);
int reftype = buffer.readInt();
- switch (reftype) {
- case SERIALIZE_PIXELTYPE_REF_DATA: {
- size_t offset = buffer.readUInt();
- SkPixelRef* pr = buffer.readPixelRef();
- SkSafeUnref(this->setPixelRef(pr, offset));
- break;
+ if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||
+ (SERIALIZE_PIXELTYPE_NONE == reftype))) {
+ switch (reftype) {
+ case SERIALIZE_PIXELTYPE_REF_DATA: {
+ size_t offset = buffer.readUInt();
+ SkPixelRef* pr = buffer.readPixelRef();
+ SkSafeUnref(this->setPixelRef(pr, offset));
+ break;
+ }
+ case SERIALIZE_PIXELTYPE_NONE:
+ break;
+ default:
+ SkDEBUGFAIL("unrecognized pixeltype in serialized data");
+ sk_throw();
}
- case SERIALIZE_PIXELTYPE_NONE:
- break;
- default:
- buffer.validate(false);
- SkDEBUGFAIL("unrecognized pixeltype in serialized data");
- sk_throw();
}
}
delete[] fInputs;
}
-SkImageFilter::SkImageFilter(SkFlattenableReadBuffer& buffer)
- : fInputCount(buffer.readInt()), fInputs(new SkImageFilter*[fInputCount]) {
- for (int i = 0; i < fInputCount; i++) {
- if (buffer.readBool()) {
- fInputs[i] = buffer.readImageFilter();
- } else {
- fInputs[i] = NULL;
+SkImageFilter::SkImageFilter(int maxInputCount, SkFlattenableReadBuffer& buffer) {
+ fInputCount = buffer.readInt();
+ if (buffer.validate((fInputCount >= 0) && (fInputCount <= maxInputCount))) {
+ fInputs = new SkImageFilter*[fInputCount];
+ for (int i = 0; i < fInputCount; i++) {
+ if (buffer.readBool()) {
+ fInputs[i] = buffer.readImageFilter();
+ } else {
+ fInputs[i] = NULL;
+ }
+ }
+ SkRect rect;
+ buffer.readRect(&rect);
+ if (buffer.validate(SkIsValidRect(rect))) {
+ uint32_t flags = buffer.readUInt();
+ fCropRect = CropRect(rect, flags);
}
+ } else {
+ fInputCount = 0;
+ fInputs = NULL;
}
- SkRect rect;
- buffer.readRect(&rect);
- uint32_t flags = buffer.readUInt();
- fCropRect = CropRect(rect, flags);
- buffer.validate(SkIsValidRect(rect));
}
void SkImageFilter::flatten(SkFlattenableWriteBuffer& buffer) const {
return SkNEW_ARGS(SkBicubicImageFilter, (scale, gMitchellCoefficients, input));
}
-SkBicubicImageFilter::SkBicubicImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkBicubicImageFilter::SkBicubicImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
SkDEBUGCODE(bool success =) buffer.readScalarArray(fCoefficients, 16);
SkASSERT(success);
fScale.fWidth = buffer.readScalar();
#include "SkBitmapSource.h"
SkBitmapSource::SkBitmapSource(const SkBitmap& bitmap)
- : INHERITED(0),
+ : INHERITED(0, 0),
fBitmap(bitmap) {
}
SkBitmapSource::SkBitmapSource(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(0, buffer) {
fBitmap.unflatten(buffer);
}
#endif
SkBlurImageFilter::SkBlurImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
fSigma.fWidth = buffer.readScalar();
fSigma.fHeight = buffer.readScalar();
buffer.validate(SkScalarIsFinite(fSigma.fWidth) &&
SkSafeRef(cf);
}
-SkColorFilterImageFilter::SkColorFilterImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkColorFilterImageFilter::SkColorFilterImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
fColorFilter = buffer.readColorFilter();
}
outer->filterBounds(tmp, ctm, dst);
}
-SkComposeImageFilter::SkComposeImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkComposeImageFilter::SkComposeImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(2, buffer) {
}
}
SkDisplacementMapEffect::SkDisplacementMapEffect(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer)
+ : INHERITED(2, buffer)
{
fXChannelSelector = (SkDisplacementMapEffect::ChannelSelectorType) buffer.readInt();
fYChannelSelector = (SkDisplacementMapEffect::ChannelSelectorType) buffer.readInt();
{
}
-SkDropShadowImageFilter::SkDropShadowImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer)
-{
+SkDropShadowImageFilter::SkDropShadowImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
fDx = buffer.readScalar();
fDy = buffer.readScalar();
fSigma = buffer.readScalar();
}
SkLightingImageFilter::SkLightingImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
fLight = SkLight::UnflattenLight(buffer);
fSurfaceScale = buffer.readScalar();
buffer.validate(SkScalarIsFinite(fSurfaceScale));
SkDiffuseLightingImageFilter::SkDiffuseLightingImageFilter(SkLight* light, SkScalar surfaceScale, SkScalar kd, SkImageFilter* input, const CropRect* cropRect = NULL)
: SkLightingImageFilter(light, surfaceScale, input, cropRect),
- fKD(kd)
+ // According to the spec, kd can be any non-negative number :
+ // http://www.w3.org/TR/SVG/filters.html#feDiffuseLightingElement
+ fKD(kd < 0 ? 0 : kd)
{
}
: INHERITED(buffer)
{
fKD = buffer.readScalar();
- buffer.validate(SkScalarIsFinite(fKD));
+ buffer.validate(SkScalarIsFinite(fKD) && (fKD >= 0));
}
void SkDiffuseLightingImageFilter::flatten(SkFlattenableWriteBuffer& buffer) const {
SkSpecularLightingImageFilter::SkSpecularLightingImageFilter(SkLight* light, SkScalar surfaceScale, SkScalar ks, SkScalar shininess, SkImageFilter* input, const CropRect* cropRect)
: SkLightingImageFilter(light, surfaceScale, input, cropRect),
- fKS(ks),
+ // According to the spec, ks can be any non-negative number :
+ // http://www.w3.org/TR/SVG/filters.html#feSpecularLightingElement
+ fKS(ks < 0 ? 0 : ks),
fShininess(shininess)
{
}
{
fKS = buffer.readScalar();
fShininess = buffer.readScalar();
- buffer.validate(SkScalarIsFinite(fKS) &&
+ buffer.validate(SkScalarIsFinite(fKS) && (fKS >= 0) &&
SkScalarIsFinite(fShininess));
}
////////////////////////////////////////////////////////////////////////////////
SkMagnifierImageFilter::SkMagnifierImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
float x = buffer.readScalar();
float y = buffer.readScalar();
float width = buffer.readScalar();
}
SkMatrixConvolutionImageFilter::SkMatrixConvolutionImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
// We need to be able to read at most SK_MaxS32 bytes, so divide that
// by the size of a scalar to know how many scalars we can read.
static const int32_t kMaxSize = SK_MaxS32 / sizeof(SkScalar);
#include "SkFlattenableBuffers.h"
#include "SkValidationUtils.h"
+// Use 65535 as an arbitrary large number of inputs that this image filter should never overflow
+static const int kMaxInputs = 65535;
+
///////////////////////////////////////////////////////////////////////////////
void SkMergeImageFilter::initAllocModes() {
SkMergeImageFilter::SkMergeImageFilter(SkImageFilter* filters[], int count,
const SkXfermode::Mode modes[],
const CropRect* cropRect) : INHERITED(count, filters, cropRect) {
+ SkASSERT(count <= kMaxInputs);
this->initModes(modes);
}
}
}
-SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(kMaxInputs, buffer) {
bool hasModes = buffer.readBool();
if (hasModes) {
this->initAllocModes();
#endif
SkMorphologyImageFilter::SkMorphologyImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
fRadius.fWidth = buffer.readInt();
fRadius.fHeight = buffer.readInt();
buffer.validate((fRadius.fWidth >= 0) &&
fOffset.set(dx, dy);
}
-SkOffsetImageFilter::SkOffsetImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkOffsetImageFilter::SkOffsetImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
buffer.readPoint(&fOffset);
buffer.validate(SkScalarIsFinite(fOffset.fX) &&
SkScalarIsFinite(fOffset.fY));
return SkScalarMul(SkScalarSquare(t), SK_Scalar3 - 2 * t);
}
+bool perlin_noise_type_is_valid(SkPerlinNoiseShader::Type type) {
+ return (SkPerlinNoiseShader::kFractalNoise_Type == type) ||
+ (SkPerlinNoiseShader::kTurbulence_Type == type);
+}
+
} // end namespace
struct SkPerlinNoiseShader::StitchData {
: fType(type)
, fBaseFrequencyX(baseFrequencyX)
, fBaseFrequencyY(baseFrequencyY)
- , fNumOctaves(numOctaves & 0xFF /*[0,255] octaves allowed*/)
+ , fNumOctaves(numOctaves > 255 ? 255 : numOctaves/*[0,255] octaves allowed*/)
, fSeed(seed)
, fStitchTiles((tileSize != NULL) && !tileSize->isEmpty())
, fPaintingData(NULL)
fTileSize.fHeight = buffer.readInt();
setTileSize(fTileSize);
fMatrix.reset();
+ buffer.validate(perlin_noise_type_is_valid(fType) &&
+ (fNumOctaves >= 0) && (fNumOctaves <= 255));
}
SkPerlinNoiseShader::~SkPerlinNoiseShader() {
}
SkRectShaderImageFilter::SkRectShaderImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(1, buffer) {
fShader = buffer.readShader();
}
buffer.writeScalar(fScale);
}
-SkDownSampleImageFilter::SkDownSampleImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkDownSampleImageFilter::SkDownSampleImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
fScale = buffer.readScalar();
buffer.validate(SkScalarIsFinite(fScale));
}
return true;
}
-SkTileImageFilter::SkTileImageFilter(SkFlattenableReadBuffer& buffer) : INHERITED(buffer) {
+SkTileImageFilter::SkTileImageFilter(SkFlattenableReadBuffer& buffer)
+ : INHERITED(1, buffer) {
buffer.readRect(&fSrcRect);
buffer.readRect(&fDstRect);
buffer.validate(SkIsValidRect(fSrcRect) && SkIsValidRect(fDstRect));
}
SkXfermodeImageFilter::SkXfermodeImageFilter(SkFlattenableReadBuffer& buffer)
- : INHERITED(buffer) {
+ : INHERITED(2, buffer) {
fMode = buffer.readXfermode();
}