commit b11ce19fc25f443b917607e142047da2dd219ea6
author Khushal <khushalsagar@chromium.org> Fri Feb 14 14:07:16 2020 -0800
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Fri Feb 14 22:35:35 2020 +0000
tree 1b4497e69a084d1de7c2c37c1301df631c485905
parent ee655f8a94fe61a18ffab3f4d5c51a4ee6b782fb

images: Fix fuzzer crash for creating raster SkImage with invalid data.

TBR=mtklein@google.com

Bug:1050445
Change-Id: Iddcb3f63276b9175cfbef3e9631f0df37b7717eb
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/269910
Reviewed-by: Khushal Sagar <khushalsagar@chromium.org>
Commit-Queue: Khushal Sagar <khushalsagar@chromium.org>
Auto-Submit: Khushal Sagar <khushalsagar@chromium.org>

src/image/SkImage_Raster.cpp

diff --git a/src/image/SkImage_Raster.cpp b/src/image/SkImage_Raster.cpp
index 9e573a1..0764a4d 100644
--- a/src/image/SkImage_Raster.cpp
+++ b/src/image/SkImage_Raster.cpp
@@ -38,6 +38,12 @@
     static bool ValidArgs(const SkImageInfo& info, size_t rowBytes, size_t* minSize) {
         const int maxDimension = SK_MaxS32 >> 2;
 
+        // TODO(mtklein): eliminate anything here that setInfo() has already checked.
+        SkBitmap dummy;
+        if (!dummy.setInfo(info, rowBytes)) {
+            return false;
+        }
+
         if (info.width() <= 0 || info.height() <= 0) {
             return false;
         }