Skip to content

Commit

Permalink
cc: fix fuzzing issue with paint op buffer of size 2
Browse files Browse the repository at this point in the history
If an op contians a paint op buffer of size 2, then this code will fail.
All ops are at least size 4, so safely early out when this is not true.

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ia44fa235f1e8fbae923b0ebf407bc6f0bc0a4cbe
Reviewed-on: https://chromium-review.googlesource.com/1205533
Reviewed-by: Khushal <khushalsagar@chromium.org>
Commit-Queue: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#588915}
  • Loading branch information
quisquous authored and Commit Bot committed Sep 5, 2018
1 parent 8d9f363 commit 8f74e81
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions cc/paint/paint_op_reader.cc
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,8 @@ bool PaintOpReader::ReadAndValidateOpHeader(const volatile void* input,
size_t input_size,
uint8_t* type,
uint32_t* skip) {
if (input_size < 4)
return false;
uint32_t first_word = reinterpret_cast<const volatile uint32_t*>(input)[0];
*type = static_cast<uint8_t>(first_word & 0xFF);
*skip = first_word >> 8;
Expand Down

0 comments on commit 8f74e81

Please sign in to comment.