diff options
| author | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2014-04-29 15:35:23 +0000 |
|---|---|---|
| committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2014-04-29 15:35:23 +0000 |
| commit | 394ec1d498fc2f93a45c150aa8ad24bec26c3760 (patch) | |
| tree | d674b988ab30208fb952619e98a2284d77cdf5b0 | |
| parent | 7513b9fd838175868e97dedeff44fa2c38092b88 (diff) | |
| download | include-394ec1d498fc2f93a45c150aa8ad24bec26c3760.tar.gz | |
Fixed issue found by clusterfuzz
An integer overflow was causing an issue when reading a string with a very large (or negative) size.
BUG=367764
R=senorblanco@google.com, senorblanco@chromium.org, reed@google.com, borenet@google.com
Author: sugoi@chromium.org
Review URL: https://codereview.chromium.org/255693003
git-svn-id: http://skia.googlecode.com/svn/trunk/include@14434 2bbb7eff-a529-9590-31e7-b0007b416f81
| -rw-r--r-- | core/SkReader32.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/SkReader32.h b/core/SkReader32.h index 7e8038d..51e28ef 100644 --- a/core/SkReader32.h +++ b/core/SkReader32.h @@ -40,7 +40,7 @@ public: const void* peek() const { return fCurr; } size_t available() const { return fStop - fCurr; } - bool isAvailable(size_t size) const { return fCurr + size <= fStop; } + bool isAvailable(size_t size) const { return size <= this->available(); } void rewind() { fCurr = fBase; } |