Code: SkCodec* SkIcoCodec::NewFromStream(SkStream* stream, Result* result) {
    std::unique_ptr<SkStream> inputStream(stream);

 static const uint32_t kIcoDirectoryBytes = 6;
 static const uint32_t kIcoDirEntryBytes = 16;

    std::unique_ptr<uint8_t[]> dirBuffer(new uint8_t[kIcoDirectoryBytes]);
 if (inputStream.get()->read(dirBuffer.get(), kIcoDirectoryBytes) !=
            kIcoDirectoryBytes) {
 SkCodecPrintf("Error: unable to read ico directory header.\n");
 *result = kIncompleteInput;
 return nullptr;
 }

 const uint16_t numImages = get_short(dirBuffer.get(), 4);
 if (0 == numImages) {
 SkCodecPrintf("Error: No images embedded in ico.\n");
 *result = kInvalidInput;
 return nullptr;
 }

 struct Entry {

         uint32_t offset;
         uint32_t size;
     };
    SkAutoFree dirEntryBuffer(sk_malloc_flags(sizeof(Entry) * numImages,
                                              SK_MALLOC_TEMP));
     if (!dirEntryBuffer) {
         SkCodecPrintf("Error: OOM allocating ICO directory for %i images.\n",
                       numImages);
 *result = kInternalError;
 return nullptr;
 }
 auto* directoryEntries = reinterpret_cast<Entry*>(dirEntryBuffer.get());

 for (uint32_t i = 0; i < numImages; i++) {
 uint8_t entryBuffer[kIcoDirEntryBytes];
 if (inputStream->read(entryBuffer, kIcoDirEntryBytes) !=
                kIcoDirEntryBytes) {
 SkCodecPrintf("Error: Dir entries truncated in ico.\n");
 *result = kIncompleteInput;
 return nullptr;
 }


 uint32_t size = get_int(entryBuffer, 8);

 uint32_t offset = get_int(entryBuffer, 12);

        directoryEntries[i].offset = offset;
        directoryEntries[i].size = size;
 }

 *result = kInvalidInput;

 struct EntryLessThan {
 bool operator() (Entry a, Entry b) const {
 return a.offset < b.offset;
 }
 };
 EntryLessThan lessThan;
 SkTQSort(directoryEntries, &directoryEntries[numImages - 1], lessThan);

 uint32_t bytesRead = kIcoDirectoryBytes + numImages * kIcoDirEntryBytes;
    std::unique_ptr<SkTArray<std::unique_ptr<SkCodec>, true>> codecs(
 new (SkTArray<std::unique_ptr<SkCodec>, true>)(numImages));
 for (uint32_t i = 0; i < numImages; i++) {
 uint32_t offset = directoryEntries[i].offset;
 uint32_t size = directoryEntries[i].size;

 if (offset < bytesRead) {
 SkCodecPrintf("Warning: invalid ico offset.\n");
 continue;
 }

 if (inputStream.get()->skip(offset - bytesRead) != offset - bytesRead) {
 SkCodecPrintf("Warning: could not skip to ico offset.\n");
 break;
 }

         bytesRead = offset;
 
        SkAutoFree buffer(sk_malloc_flags(size, 0));
         if (!buffer) {
             SkCodecPrintf("Warning: OOM trying to create embedded stream.\n");
             break;
 }

 if (inputStream->read(buffer.get(), size) != size) {
 SkCodecPrintf("Warning: could not create embedded stream.\n");
 *result = kIncompleteInput;
 break;
 }

        sk_sp<SkData> data(SkData::MakeFromMalloc(buffer.release(), size));
        std::unique_ptr<SkMemoryStream> embeddedStream(new SkMemoryStream(data));
        bytesRead += size;

 SkCodec* codec = nullptr;
 Result dummyResult;
 if (SkPngCodec::IsPng((const char*) data->bytes(), data->size())) {
            codec = SkPngCodec::NewFromStream(embeddedStream.release(), &dummyResult);
 } else {
            codec = SkBmpCodec::NewFromIco(embeddedStream.release(), &dummyResult);
 }

 if (nullptr != codec) {
            codecs->push_back().reset(codec);
 }
 }

 if (0 == codecs->count()) {
 SkCodecPrintf("Error: could not find any valid embedded ico codecs.\n");
 return nullptr;
 }

 size_t maxSize = 0;
 int maxIndex = 0;
 for (int i = 0; i < codecs->count(); i++) {
 SkImageInfo info = codecs->operator[](i)->getInfo();
 size_t size = info.getSafeSize(info.minRowBytes());

 if (size > maxSize) {
            maxSize = size;
            maxIndex = i;
 }
 }
 int width = codecs->operator[](maxIndex)->getInfo().width();
 int height = codecs->operator[](maxIndex)->getInfo().height();
 SkEncodedInfo info = codecs->operator[](maxIndex)->getEncodedInfo();
 SkColorSpace* colorSpace = codecs->operator[](maxIndex)->getInfo().colorSpace();

 *result = kSuccess;
 return new SkIcoCodec(width, height, info, codecs.release(), sk_ref_sp(colorSpace));
}

Vulnerability Type: Exec Code Overflow 
CWE ID: CWE-787
Summary: In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78354855
Commit Message: RESTRICT AUTOMERGE: Cherry-pick "begin cleanup of malloc porting layer"

Bug: 78354855
Test: Not feasible

Original description:
========================================================================
1. Merge some of the allocators into sk_malloc_flags by redefining a flag to mean zero-init
2. Add more private helpers to simplify our call-sites (and handle some overflow mul checks)
3. The 2-param helpers rely on the saturating SkSafeMath::Mul to pass max_size_t as the request,
which should always fail.

chromium: 508641
Reviewed-on: https://skia-review.googlesource.com/90940
Commit-Queue: Mike Reed <reed@google.com>
Reviewed-by: Robert Phillips <robertphillips@google.com>
Reviewed-by: Stephan Altmueller <stephana@google.com>
========================================================================

Conflicts:
- include/private/SkMalloc.h
Simply removed the old definitions of SK_MALLOC_TEMP and SK_MALLOC_THROW.
- public.bzl
Copied SK_SUPPORT_LEGACY_MALLOC_PORTING_LAYER into the old defines.
- src/codec/SkIcoCodec.cpp
Drop a change where we were not using malloc yet.
- src/codec/SkBmpBaseCodec.cpp
- src/core/SkBitmapCache.cpp
These files weren't yet using malloc (and SkBmpBaseCodec hadn't been
factored out).
- src/core/SkMallocPixelRef.cpp
These were still using New rather than Make (return raw pointer). Leave
them unchanged, as sk_malloc_flags is still valid.
- src/lazy/SkDiscardableMemoryPool.cpp
Leave this unchanged; sk_malloc_flags is still valid

In addition, pull in SkSafeMath.h, which was originally introduced in
https://skia-review.googlesource.com/c/skia/+/33721. This is required
for the new sk_malloc calls.

Also pull in SkSafeMath::Add and SkSafeMath::Mul, introduced in
https://skia-review.googlesource.com/88581

Also add SK_MaxSizeT, which the above depends on, introduced in
https://skia-review.googlesource.com/57084

Also, modify NewFromStream to use sk_malloc_canfail, matching pi and
avoiding a build break

Change-Id: Ib320484673a865460fc1efb900f611209e088edb
(cherry picked from commit a12cc3e14ea6734c7efe76aa6a19239909830b28)
