Do not attempt to decode NULL SkData.

NewFromFD fails if mmap fails. In that case, it returns a NULL
SkData. SkMemoryStream handles NULL input by calling SkData::NewEmpty,
which is not threadsafe. If the SkMemoryStream were to get some
busted SkData, its call to read might fail. Sidestep this problem
by not creating the SkMemoryStream if the SkData is NULL, skipping
the call to SkData::NewEmpty.

BUG:11028218
Change-Id: Id70299bef1c85ffb5d17102fdb5ea071b0bee68a

diff --git a/core/jni/android/graphics/BitmapFactory.cpp b/core/jni/android/graphics/BitmapFactory.cpp
index 0d757f7..da6219f 100644 (file)
--- a/core/jni/android/graphics/BitmapFactory.cpp
+++ b/core/jni/android/graphics/BitmapFactory.cpp
@@ -514,6 +514,9 @@ static jobject nativeDecodeFileDescriptor(JNIEnv* env, jobject clazz, jobject fi
     }
 
     SkAutoTUnref<SkData> data(SkData::NewFromFD(descriptor));
+    if (data.get() == NULL) {
+        return nullObjectReturn("NewFromFD failed in nativeDecodeFileDescriptor");
+    }
     SkAutoTUnref<SkMemoryStream> stream(new SkMemoryStream(data));
 
     /* Allow purgeable iff we own the FD, i.e., in the puregeable and