diff options
| author | Leon Scroggins III <scroggo@google.com> | 2015-05-21 19:05:45 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-05-21 19:05:46 +0000 |
| commit | aba3ecb976cacd7c92fe8f8afae20d112781d68e (patch) | |
| tree | 10975cc472f7e97f514bd3facb46d86bc0d0cf3c /core | |
| parent | bbb0ae13e2d1767dda1e0cf3e3546332d80379d2 (diff) | |
| parent | 462dd010467fdf1ab0cb49e021a92d14f2163c8c (diff) | |
| download | frameworks_base-aba3ecb976cacd7c92fe8f8afae20d112781d68e.zip frameworks_base-aba3ecb976cacd7c92fe8f8afae20d112781d68e.tar.gz frameworks_base-aba3ecb976cacd7c92fe8f8afae20d112781d68e.tar.bz2 | |
Merge "Fix overflow in NinePatchImpl." into mnc-dev
Diffstat (limited to 'core')
| -rw-r--r-- | core/jni/android/graphics/NinePatchImpl.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/core/jni/android/graphics/NinePatchImpl.cpp b/core/jni/android/graphics/NinePatchImpl.cpp index 323f832..978c4a5 100644 --- a/core/jni/android/graphics/NinePatchImpl.cpp +++ b/core/jni/android/graphics/NinePatchImpl.cpp @@ -180,7 +180,10 @@ void NinePatch_Draw(SkCanvas* canvas, const SkRect& bounds, const int bitmapWidth = bitmap.width(); const int bitmapHeight = bitmap.height(); - SkScalar* dstRights = (SkScalar*) alloca((numXDivs + 1) * sizeof(SkScalar)); + // Number of bytes needed for dstRights array. + // Need to cast numXDivs to a larger type to avoid overflow. + const size_t dstBytes = ((size_t) numXDivs + 1) * sizeof(SkScalar); + SkScalar* dstRights = (SkScalar*) alloca(dstBytes); bool dstRightsHaveBeenCached = false; int numStretchyXPixelsRemaining = 0; |