Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 462dd010 authored by Leon Scroggins III's avatar Leon Scroggins III
Browse files

Fix overflow in NinePatchImpl. 

Cast numXDivs to a size_t before adding 1, so that if numXDivs is 255
it does not overflow. Move the calculation outside of alloca().

BUG:20727488
Change-Id: I2ecc9d650338acba7316554cb72195e02816b1f8
parent d457c71e

core/jni/android/graphics/NinePatchImpl.cpp

+4 −1
Original line number Diff line number Diff line
@@ -180,7 +180,10 @@ void NinePatch_Draw(SkCanvas* canvas, const SkRect& bounds, 
    const int bitmapWidth = bitmap.width();

    const int bitmapHeight = bitmap.height();



    SkScalar* dstRights = (SkScalar*) alloca((numXDivs + 1) * sizeof(SkScalar));

    // Number of bytes needed for dstRights array.

    // Need to cast numXDivs to a larger type to avoid overflow.

    const size_t dstBytes = ((size_t) numXDivs + 1) * sizeof(SkScalar);

    SkScalar* dstRights = (SkScalar*) alloca(dstBytes);

    bool dstRightsHaveBeenCached = false;



    int numStretchyXPixelsRemaining = 0;