return NULL;\r
}\r
\r
- SkBitmap* bitmap = new SkBitmap;\r
+ SkAutoTDelete<SkBitmap> bitmap(new SkBitmap);\r
\r
- bitmap->setConfig(config, width, height, rowBytes);\r
+ if (!bitmap->setConfig(config, width, height, rowBytes)) {\r
+ return NULL;\r
+ }\r
\r
SkColorTable* ctable = NULL;\r
if (config == SkBitmap::kIndex8_Config) {\r
int count = p->readInt32();\r
+ if (count < 0 || count > 256) {\r
+ // The data is corrupt, since SkColorTable enforces a value between 0 and 256,\r
+ // inclusive.\r
+ return NULL;\r
+ }\r
if (count > 0) {\r
size_t size = count * sizeof(SkPMColor);\r
const SkPMColor* src = (const SkPMColor*)p->readInplace(size);\r
+ if (src == NULL) {\r
+ return NULL;\r
+ }\r
ctable = new SkColorTable(src, count);\r
}\r
}\r
\r
- jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable);\r
+ jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap.get(), ctable);\r
if (NULL == buffer) {\r
SkSafeUnref(ctable);\r
- delete bitmap;\r
return NULL;\r
}\r
\r
android::status_t status = p->readBlob(size, &blob);\r
if (status) {\r
doThrowRE(env, "Could not read bitmap from parcel blob.");\r
- delete bitmap;\r
return NULL;\r
}\r
\r
\r
blob.release();\r
\r
- return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable),\r
- NULL, NULL, density);\r
+ return GraphicsJNI::createBitmap(env, bitmap.detach(), buffer,\r
+ getPremulBitmapCreateFlags(isMutable), NULL, NULL, density);\r
}\r
\r
static jboolean Bitmap_writeToParcel(JNIEnv* env, jobject,\r