From f40b24913a99fc6fcc4b7f60e4dfcda980a16ee1 Mon Sep 17 00:00:00 2001
From: Florin Malita <fmalita@chromium.org>
Date: Wed, 3 May 2017 15:23:21 -0400
Subject: [PATCH] Validate SkSpecialSurface raster info

BUG=chromium:716311

Change-Id: I01ea2e77ba8920f735395dd46ef2cea78a858308
Reviewed-on: https://skia-review.googlesource.com/15230
Reviewed-by: Mike Reed <reed@google.com>
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Florin Malita <fmalita@chromium.org>
---
 src/core/SkSpecialSurface.cpp  |  7 +++++++
 src/core/SkSurfacePriv.h       |  6 ++++++
 src/image/SkSurface_Raster.cpp | 10 +++-------
 3 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/core/SkSpecialSurface.cpp b/src/core/SkSpecialSurface.cpp
index dfd15b2..3e812d4 100644
--- a/src/core/SkSpecialSurface.cpp
+++ b/src/core/SkSpecialSurface.cpp
@@ -93,11 +93,18 @@ private:
 
 sk_sp<SkSpecialSurface> SkSpecialSurface::MakeFromBitmap(const SkIRect& subset, SkBitmap& bm,
                                                          const SkSurfaceProps* props) {
+    if (subset.isEmpty() || !SkSurfaceValidateRasterInfo(bm.info(), bm.rowBytes())) {
+        return nullptr;
+    }
     return sk_make_sp<SkSpecialSurface_Raster>(bm.info(), sk_ref_sp(bm.pixelRef()), subset, props);
 }
 
 sk_sp<SkSpecialSurface> SkSpecialSurface::MakeRaster(const SkImageInfo& info,
                                                      const SkSurfaceProps* props) {
+    if (!SkSurfaceValidateRasterInfo(info)) {
+        return nullptr;
+    }
+
     sk_sp<SkPixelRef> pr = SkMallocPixelRef::MakeZeroed(info, 0, nullptr);
     if (!pr) {
         return nullptr;
diff --git a/src/core/SkSurfacePriv.h b/src/core/SkSurfacePriv.h
index 74d19a6..a41b583 100644
--- a/src/core/SkSurfacePriv.h
+++ b/src/core/SkSurfacePriv.h
@@ -10,6 +10,8 @@
 
 #include "SkSurfaceProps.h"
 
+struct SkImageInfo;
+
 static inline SkSurfaceProps SkSurfacePropsCopyOrDefault(const SkSurfaceProps* props) {
     if (props) {
         return *props;
@@ -22,4 +24,8 @@ static inline SkPixelGeometry SkSurfacePropsDefaultPixelGeometry() {
     return SkSurfaceProps(SkSurfaceProps::kLegacyFontHost_InitType).pixelGeometry();
 }
 
+constexpr size_t kIgnoreRowBytesValue = static_cast<size_t>(~0);
+
+bool SkSurfaceValidateRasterInfo(const SkImageInfo&, size_t rb = kIgnoreRowBytesValue);
+
 #endif
diff --git a/src/image/SkSurface_Raster.cpp b/src/image/SkSurface_Raster.cpp
index c4796c4..1ee3d7e 100644
--- a/src/image/SkSurface_Raster.cpp
+++ b/src/image/SkSurface_Raster.cpp
@@ -11,12 +11,8 @@
 #include "SkDevice.h"
 #include "SkMallocPixelRef.h"
 
-static const size_t kIgnoreRowBytesValue = (size_t)~0;
-
 class SkSurface_Raster : public SkSurface_Base {
 public:
-    static bool Valid(const SkImageInfo&, size_t rb = kIgnoreRowBytesValue);
-
     SkSurface_Raster(const SkImageInfo&, void*, size_t rb,
                      void (*releaseProc)(void* pixels, void* context), void* context,
                      const SkSurfaceProps*);
@@ -39,7 +35,7 @@ private:
 
 ///////////////////////////////////////////////////////////////////////////////
 
-bool SkSurface_Raster::Valid(const SkImageInfo& info, size_t rowBytes) {
+bool SkSurfaceValidateRasterInfo(const SkImageInfo& info, size_t rowBytes) {
     if (info.isEmpty()) {
         return false;
     }
@@ -186,7 +182,7 @@ sk_sp<SkSurface> SkSurface::MakeRasterDirectReleaseProc(const SkImageInfo& info,
     if (nullptr == releaseProc) {
         context = nullptr;
     }
-    if (!SkSurface_Raster::Valid(info, rb)) {
+    if (!SkSurfaceValidateRasterInfo(info, rb)) {
         return nullptr;
     }
     if (nullptr == pixels) {
@@ -203,7 +199,7 @@ sk_sp<SkSurface> SkSurface::MakeRasterDirect(const SkImageInfo& info, void* pixe
 
 sk_sp<SkSurface> SkSurface::MakeRaster(const SkImageInfo& info, size_t rowBytes,
                                        const SkSurfaceProps* props) {
-    if (!SkSurface_Raster::Valid(info)) {
+    if (!SkSurfaceValidateRasterInfo(info)) {
         return nullptr;
     }
 
-- 
2.7.4