Fix overflow in NinePatchImpl.

Cast numXDivs to a size_t before adding 1, so that if numXDivs is 255
it does not overflow. Move the calculation outside of alloca().

BUG:20727488
Change-Id: I2ecc9d650338acba7316554cb72195e02816b1f8

1 files changed, 4 insertions, 1 deletions

diff --git a/core/jni/android/graphics/NinePatchImpl.cpp b/core/jni/android/graphics/NinePatchImpl.cpp
index 323f832..978c4a5 100644
--- a/core/jni/android/graphics/NinePatchImpl.cpp
+++ b/core/jni/android/graphics/NinePatchImpl.cpp
@@ -180,7 +180,10 @@ void NinePatch_Draw(SkCanvas* canvas, const SkRect& bounds,
     const int bitmapWidth = bitmap.width();
     const int bitmapHeight = bitmap.height();
 
-    SkScalar* dstRights = (SkScalar*) alloca((numXDivs + 1) * sizeof(SkScalar));
+    // Number of bytes needed for dstRights array.
+    // Need to cast numXDivs to a larger type to avoid overflow.
+    const size_t dstBytes = ((size_t) numXDivs + 1) * sizeof(SkScalar);
+    SkScalar* dstRights = (SkScalar*) alloca(dstBytes);
     bool dstRightsHaveBeenCached = false;
 
     int numStretchyXPixelsRemaining = 0;