SkReadBuffer.cpp 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465
  1. /*
  2. * Copyright 2012 Google Inc.
  3. *
  4. * Use of this source code is governed by a BSD-style license that can be
  5. * found in the LICENSE file.
  6. */
  7. #include "include/core/SkBitmap.h"
  8. #include "include/core/SkData.h"
  9. #include "include/core/SkImage.h"
  10. #include "include/core/SkImageGenerator.h"
  11. #include "include/core/SkStream.h"
  12. #include "include/core/SkTypeface.h"
  13. #include "src/core/SkAutoMalloc.h"
  14. #include "src/core/SkMakeUnique.h"
  15. #include "src/core/SkMathPriv.h"
  16. #include "src/core/SkMatrixPriv.h"
  17. #include "src/core/SkReadBuffer.h"
  18. #include "src/core/SkSafeMath.h"
  19. #ifndef SK_DISABLE_READBUFFER
  20. namespace {
  21. // This generator intentionally should always fail on all attempts to get its pixels,
  22. // simulating a bad or empty codec stream.
  23. class EmptyImageGenerator final : public SkImageGenerator {
  24. public:
  25. EmptyImageGenerator(const SkImageInfo& info) : INHERITED(info) { }
  26. private:
  27. typedef SkImageGenerator INHERITED;
  28. };
  29. static sk_sp<SkImage> MakeEmptyImage(int width, int height) {
  30. return SkImage::MakeFromGenerator(
  31. skstd::make_unique<EmptyImageGenerator>(SkImageInfo::MakeN32Premul(width, height)));
  32. }
  33. } // anonymous namespace
  34. SkReadBuffer::SkReadBuffer() {
  35. fVersion = 0;
  36. fTFArray = nullptr;
  37. fTFCount = 0;
  38. fFactoryArray = nullptr;
  39. fFactoryCount = 0;
  40. }
  41. SkReadBuffer::SkReadBuffer(const void* data, size_t size) {
  42. fVersion = 0;
  43. this->setMemory(data, size);
  44. fTFArray = nullptr;
  45. fTFCount = 0;
  46. fFactoryArray = nullptr;
  47. fFactoryCount = 0;
  48. }
  49. void SkReadBuffer::setMemory(const void* data, size_t size) {
  50. this->validate(IsPtrAlign4(data) && (SkAlign4(size) == size));
  51. if (!fError) {
  52. fReader.setMemory(data, size);
  53. }
  54. }
  55. void SkReadBuffer::setInvalid() {
  56. if (!fError) {
  57. // When an error is found, send the read cursor to the end of the stream
  58. fReader.skip(fReader.available());
  59. fError = true;
  60. }
  61. }
  62. const void* SkReadBuffer::skip(size_t size) {
  63. size_t inc = SkAlign4(size);
  64. this->validate(inc >= size);
  65. const void* addr = fReader.peek();
  66. this->validate(IsPtrAlign4(addr) && fReader.isAvailable(inc));
  67. if (fError) {
  68. return nullptr;
  69. }
  70. fReader.skip(size);
  71. return addr;
  72. }
  73. const void* SkReadBuffer::skip(size_t count, size_t size) {
  74. return this->skip(SkSafeMath::Mul(count, size));
  75. }
  76. void SkReadBuffer::setDeserialProcs(const SkDeserialProcs& procs) {
  77. fProcs = procs;
  78. }
  79. bool SkReadBuffer::readBool() {
  80. uint32_t value = this->readUInt();
  81. // Boolean value should be either 0 or 1
  82. this->validate(!(value & ~1));
  83. return value != 0;
  84. }
  85. SkColor SkReadBuffer::readColor() {
  86. return this->readUInt();
  87. }
  88. int32_t SkReadBuffer::readInt() {
  89. const size_t inc = sizeof(int32_t);
  90. this->validate(IsPtrAlign4(fReader.peek()) && fReader.isAvailable(inc));
  91. return fError ? 0 : fReader.readInt();
  92. }
  93. SkScalar SkReadBuffer::readScalar() {
  94. const size_t inc = sizeof(SkScalar);
  95. this->validate(IsPtrAlign4(fReader.peek()) && fReader.isAvailable(inc));
  96. return fError ? 0 : fReader.readScalar();
  97. }
  98. uint32_t SkReadBuffer::readUInt() {
  99. return this->readInt();
  100. }
  101. int32_t SkReadBuffer::read32() {
  102. return this->readInt();
  103. }
  104. uint8_t SkReadBuffer::peekByte() {
  105. if (fReader.available() <= 0) {
  106. fError = true;
  107. return 0;
  108. }
  109. return *((uint8_t*) fReader.peek());
  110. }
  111. bool SkReadBuffer::readPad32(void* buffer, size_t bytes) {
  112. if (const void* src = this->skip(bytes)) {
  113. memcpy(buffer, src, bytes);
  114. return true;
  115. }
  116. return false;
  117. }
  118. const char* SkReadBuffer::readString(size_t* len) {
  119. *len = this->readUInt();
  120. // The string is len characters and a terminating \0.
  121. const char* c_str = this->skipT<char>(*len+1);
  122. if (this->validate(c_str && c_str[*len] == '\0')) {
  123. return c_str;
  124. }
  125. return nullptr;
  126. }
  127. void SkReadBuffer::readString(SkString* string) {
  128. size_t len;
  129. if (const char* c_str = this->readString(&len)) {
  130. string->set(c_str, len);
  131. return;
  132. }
  133. string->reset();
  134. }
  135. void SkReadBuffer::readColor4f(SkColor4f* color) {
  136. if (!this->readPad32(color, sizeof(SkColor4f))) {
  137. *color = {0, 0, 0, 0};
  138. }
  139. }
  140. void SkReadBuffer::readPoint(SkPoint* point) {
  141. point->fX = this->readScalar();
  142. point->fY = this->readScalar();
  143. }
  144. void SkReadBuffer::readPoint3(SkPoint3* point) {
  145. this->readPad32(point, sizeof(SkPoint3));
  146. }
  147. void SkReadBuffer::readMatrix(SkMatrix* matrix) {
  148. size_t size = 0;
  149. if (this->isValid()) {
  150. size = SkMatrixPriv::ReadFromMemory(matrix, fReader.peek(), fReader.available());
  151. (void)this->validate((SkAlign4(size) == size) && (0 != size));
  152. }
  153. if (!this->isValid()) {
  154. matrix->reset();
  155. }
  156. (void)this->skip(size);
  157. }
  158. void SkReadBuffer::readIRect(SkIRect* rect) {
  159. if (!this->readPad32(rect, sizeof(SkIRect))) {
  160. rect->setEmpty();
  161. }
  162. }
  163. void SkReadBuffer::readRect(SkRect* rect) {
  164. if (!this->readPad32(rect, sizeof(SkRect))) {
  165. rect->setEmpty();
  166. }
  167. }
  168. void SkReadBuffer::readRRect(SkRRect* rrect) {
  169. if (!this->validate(fReader.readRRect(rrect))) {
  170. rrect->setEmpty();
  171. }
  172. }
  173. void SkReadBuffer::readRegion(SkRegion* region) {
  174. size_t size = 0;
  175. if (!fError) {
  176. size = region->readFromMemory(fReader.peek(), fReader.available());
  177. if (!this->validate((SkAlign4(size) == size) && (0 != size))) {
  178. region->setEmpty();
  179. }
  180. }
  181. (void)this->skip(size);
  182. }
  183. void SkReadBuffer::readPath(SkPath* path) {
  184. size_t size = 0;
  185. if (!fError) {
  186. size = path->readFromMemory(fReader.peek(), fReader.available());
  187. if (!this->validate((SkAlign4(size) == size) && (0 != size))) {
  188. path->reset();
  189. }
  190. }
  191. (void)this->skip(size);
  192. }
  193. bool SkReadBuffer::readArray(void* value, size_t size, size_t elementSize) {
  194. const uint32_t count = this->readUInt();
  195. return this->validate(size == count) &&
  196. this->readPad32(value, SkSafeMath::Mul(size, elementSize));
  197. }
  198. bool SkReadBuffer::readByteArray(void* value, size_t size) {
  199. return this->readArray(value, size, sizeof(uint8_t));
  200. }
  201. bool SkReadBuffer::readColorArray(SkColor* colors, size_t size) {
  202. return this->readArray(colors, size, sizeof(SkColor));
  203. }
  204. bool SkReadBuffer::readColor4fArray(SkColor4f* colors, size_t size) {
  205. return this->readArray(colors, size, sizeof(SkColor4f));
  206. }
  207. bool SkReadBuffer::readIntArray(int32_t* values, size_t size) {
  208. return this->readArray(values, size, sizeof(int32_t));
  209. }
  210. bool SkReadBuffer::readPointArray(SkPoint* points, size_t size) {
  211. return this->readArray(points, size, sizeof(SkPoint));
  212. }
  213. bool SkReadBuffer::readScalarArray(SkScalar* values, size_t size) {
  214. return this->readArray(values, size, sizeof(SkScalar));
  215. }
  216. sk_sp<SkData> SkReadBuffer::readByteArrayAsData() {
  217. size_t numBytes = this->getArrayCount();
  218. if (!this->validate(fReader.isAvailable(numBytes))) {
  219. return nullptr;
  220. }
  221. SkAutoMalloc buffer(numBytes);
  222. if (!this->readByteArray(buffer.get(), numBytes)) {
  223. return nullptr;
  224. }
  225. return SkData::MakeFromMalloc(buffer.release(), numBytes);
  226. }
  227. uint32_t SkReadBuffer::getArrayCount() {
  228. const size_t inc = sizeof(uint32_t);
  229. fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc);
  230. return fError ? 0 : *(uint32_t*)fReader.peek();
  231. }
  232. /* Format:
  233. * (subset) width, height
  234. * (subset) origin x, y
  235. * size (31bits)
  236. * data [ encoded, with raw width/height ]
  237. */
  238. sk_sp<SkImage> SkReadBuffer::readImage() {
  239. SkIRect bounds;
  240. if (this->isVersionLT(kStoreImageBounds_Version)) {
  241. bounds.fLeft = bounds.fTop = 0;
  242. bounds.fRight = this->read32();
  243. bounds.fBottom = this->read32();
  244. } else {
  245. this->readIRect(&bounds);
  246. }
  247. const int width = bounds.width();
  248. const int height = bounds.height();
  249. if (width <= 0 || height <= 0) { // SkImage never has a zero dimension
  250. this->validate(false);
  251. return nullptr;
  252. }
  253. int32_t size = this->read32();
  254. if (size == SK_NaN32) {
  255. // 0x80000000 is never valid, since it cannot be passed to abs().
  256. this->validate(false);
  257. return nullptr;
  258. }
  259. if (size == 0) {
  260. // The image could not be encoded at serialization time - return an empty placeholder.
  261. return MakeEmptyImage(width, height);
  262. }
  263. // we used to negate the size for "custom" encoded images -- ignore that signal (Dec-2017)
  264. size = SkAbs32(size);
  265. if (size == 1) {
  266. // legacy check (we stopped writing this for "raw" images Nov-2017)
  267. this->validate(false);
  268. return nullptr;
  269. }
  270. // Preflight check to make sure there's enough stuff in the buffer before
  271. // we allocate the memory. This helps the fuzzer avoid OOM when it creates
  272. // bad/corrupt input.
  273. if (!this->validateCanReadN<uint8_t>(size)) {
  274. return nullptr;
  275. }
  276. sk_sp<SkData> data = SkData::MakeUninitialized(size);
  277. if (!this->readPad32(data->writable_data(), size)) {
  278. this->validate(false);
  279. return nullptr;
  280. }
  281. if (this->isVersionLT(kDontNegateImageSize_Version)) {
  282. (void)this->read32(); // originX
  283. (void)this->read32(); // originY
  284. }
  285. sk_sp<SkImage> image;
  286. if (fProcs.fImageProc) {
  287. image = fProcs.fImageProc(data->data(), data->size(), fProcs.fImageCtx);
  288. }
  289. if (!image) {
  290. image = SkImage::MakeFromEncoded(std::move(data));
  291. }
  292. if (image) {
  293. if (bounds.x() || bounds.y() || width < image->width() || height < image->height()) {
  294. image = image->makeSubset(bounds);
  295. }
  296. }
  297. // Question: are we correct to return an "empty" image instead of nullptr, if the decoder
  298. // failed for some reason?
  299. return image ? image : MakeEmptyImage(width, height);
  300. }
  301. sk_sp<SkTypeface> SkReadBuffer::readTypeface() {
  302. // Read 32 bits (signed)
  303. // 0 -- return null (default font)
  304. // >0 -- index
  305. // <0 -- custom (serial procs) : negative size in bytes
  306. int32_t index = this->read32();
  307. if (index == 0) {
  308. return nullptr;
  309. } else if (index > 0) {
  310. if (!this->validate(index <= fTFCount)) {
  311. return nullptr;
  312. }
  313. return fTFArray[index - 1];
  314. } else { // custom
  315. size_t size = sk_negate_to_size_t(index);
  316. const void* data = this->skip(size);
  317. if (!this->validate(data != nullptr && fProcs.fTypefaceProc)) {
  318. return nullptr;
  319. }
  320. return fProcs.fTypefaceProc(data, size, fProcs.fTypefaceCtx);
  321. }
  322. }
  323. SkFlattenable* SkReadBuffer::readFlattenable(SkFlattenable::Type ft) {
  324. SkFlattenable::Factory factory = nullptr;
  325. if (fFactoryCount > 0) {
  326. int32_t index = this->read32();
  327. if (0 == index || !this->isValid()) {
  328. return nullptr; // writer failed to give us the flattenable
  329. }
  330. index -= 1; // we stored the index-base-1
  331. if ((unsigned)index >= (unsigned)fFactoryCount) {
  332. this->validate(false);
  333. return nullptr;
  334. }
  335. factory = fFactoryArray[index];
  336. } else {
  337. if (this->peekByte() != 0) {
  338. // If the first byte is non-zero, the flattenable is specified by a string.
  339. size_t ignored_length;
  340. if (const char* name = this->readString(&ignored_length)) {
  341. factory = SkFlattenable::NameToFactory(name);
  342. fFlattenableDict.set(fFlattenableDict.count() + 1, factory);
  343. }
  344. } else {
  345. // Read the index. We are guaranteed that the first byte
  346. // is zeroed, so we must shift down a byte.
  347. uint32_t index = this->readUInt() >> 8;
  348. if (index == 0) {
  349. return nullptr; // writer failed to give us the flattenable
  350. }
  351. if (SkFlattenable::Factory* found = fFlattenableDict.find(index)) {
  352. factory = *found;
  353. }
  354. }
  355. if (!this->validate(factory != nullptr)) {
  356. return nullptr;
  357. }
  358. }
  359. // if we get here, factory may still be null, but if that is the case, the
  360. // failure was ours, not the writer.
  361. sk_sp<SkFlattenable> obj;
  362. uint32_t sizeRecorded = this->read32();
  363. if (factory) {
  364. size_t offset = fReader.offset();
  365. obj = (*factory)(*this);
  366. // check that we read the amount we expected
  367. size_t sizeRead = fReader.offset() - offset;
  368. if (sizeRecorded != sizeRead) {
  369. this->validate(false);
  370. return nullptr;
  371. }
  372. if (obj && obj->getFlattenableType() != ft) {
  373. this->validate(false);
  374. return nullptr;
  375. }
  376. } else {
  377. // we must skip the remaining data
  378. fReader.skip(sizeRecorded);
  379. }
  380. if (!this->isValid()) {
  381. return nullptr;
  382. }
  383. return obj.release();
  384. }
  385. ///////////////////////////////////////////////////////////////////////////////////////////////////
  386. int32_t SkReadBuffer::checkInt(int32_t min, int32_t max) {
  387. SkASSERT(min <= max);
  388. int32_t value = this->read32();
  389. if (value < min || value > max) {
  390. this->validate(false);
  391. value = min;
  392. }
  393. return value;
  394. }
  395. SkFilterQuality SkReadBuffer::checkFilterQuality() {
  396. return this->checkRange<SkFilterQuality>(kNone_SkFilterQuality, kLast_SkFilterQuality);
  397. }
  398. #endif // #ifndef SK_DISABLE_READBUFFER