Skip to content
This repository has been archived by the owner on Jan 23, 2025. It is now read-only.

Commit

Permalink
Fix for CVE-2020-16010 (Heap buffer overflow in UI in Google Chrome o…
Browse files Browse the repository at this point in the history 
…n Android)
  • Loading branch information
@kiwibrowser
kiwibrowser authored Nov 5, 2020
1 parent b294441 commit 66341b7
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions ui/gfx/android/java_bitmap.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@

#include "base/android/jni_string.h"
#include "base/logging.h"
#include "base/numerics/safe_conversions.h"
#include "jni/BitmapHelper_jni.h"
#include "ui/gfx/geometry/size.h"

Expand Down Expand Up @@ -77,6 +78,8 @@ ScopedJavaLocalRef<jobject> ConvertToJavaBitmap(const SkBitmap* skbitmap) {
JavaBitmap dst_lock(jbitmap);
void* src_pixels = skbitmap->getPixels();
void* dst_pixels = dst_lock.pixels();
CHECK_GE(base::checked_cast<size_t>(dst_lock.byte_count()),
skbitmap->computeByteSize());
memcpy(dst_pixels, src_pixels, skbitmap->computeByteSize());

return jbitmap;
Expand Down

0 comments on commit 66341b7

Please sign in to comment.