@@ -17,7 +17,7 @@ use YuvImageDisplayItem;
17
17
use bincode;
18
18
use serde:: { Deserialize , Serialize , Serializer } ;
19
19
use serde:: ser:: { SerializeMap , SerializeSeq } ;
20
- use std:: io:: Write ;
20
+ use std:: io:: { Read , Write } ;
21
21
use std:: { io, ptr} ;
22
22
use std:: marker:: PhantomData ;
23
23
use time:: precise_time_ns;
@@ -179,6 +179,45 @@ fn skip_slice<T: for<'de> Deserialize<'de>>(
179
179
( range, count)
180
180
}
181
181
182
+ struct UnsafeReader < ' a : ' b , ' b > {
183
+ buf : * const u8 ,
184
+ end : * const u8 ,
185
+ slice : & ' b mut & ' a [ u8 ]
186
+ }
187
+
188
+ impl < ' a , ' b > UnsafeReader < ' a , ' b > {
189
+ fn new ( buf : & ' b mut & ' a [ u8 ] ) -> UnsafeReader < ' a , ' b > {
190
+ unsafe {
191
+ let end = buf. as_ptr ( ) . offset ( buf. len ( ) as isize ) ;
192
+ let start = buf. as_ptr ( ) ;
193
+ UnsafeReader { buf : start, end, slice : buf }
194
+ }
195
+ }
196
+ }
197
+
198
+ use std:: slice;
199
+
200
+ impl < ' a , ' b > Drop for UnsafeReader < ' a , ' b > {
201
+ fn drop ( & mut self ) {
202
+ unsafe {
203
+ * self . slice = slice:: from_raw_parts ( self . buf , ( self . end as usize ) - ( self . buf as usize ) ) ;
204
+ }
205
+ }
206
+ }
207
+
208
+ impl < ' a , ' b > Read for UnsafeReader < ' a , ' b > {
209
+ fn read ( & mut self , buf : & mut [ u8 ] ) -> io:: Result < usize > {
210
+ unsafe {
211
+ if self . buf . offset ( buf. len ( ) as isize ) > self . end {
212
+ panic ! ( ) ;
213
+ }
214
+ ptr:: copy_nonoverlapping ( self . buf , buf. as_mut_ptr ( ) , buf. len ( ) ) ;
215
+ self . buf = self . buf . offset ( buf. len ( ) as isize ) ;
216
+ }
217
+ Ok ( buf. len ( ) )
218
+ }
219
+ }
220
+
182
221
impl < ' a > BuiltDisplayListIter < ' a > {
183
222
pub fn new ( list : & ' a BuiltDisplayList ) -> Self {
184
223
Self :: new_with_list_and_data ( list, list. item_slice ( ) )
@@ -229,7 +268,7 @@ impl<'a> BuiltDisplayListIter<'a> {
229
268
return None ;
230
269
}
231
270
232
- self . cur_item = bincode:: deserialize_from ( & mut self . data , bincode:: Infinite )
271
+ self . cur_item = bincode:: deserialize_from ( & mut UnsafeReader :: new ( & mut self . data ) , bincode:: Infinite )
233
272
. expect ( "MEH: malicious process?" ) ;
234
273
235
274
match self . cur_item . item {
@@ -371,7 +410,7 @@ impl<'de, 'a, T: Deserialize<'de>> AuxIter<'a, T> {
371
410
let size: usize = if data. len ( ) == 0 {
372
411
0 // Accept empty ItemRanges pointing anywhere
373
412
} else {
374
- bincode:: deserialize_from ( & mut data, bincode:: Infinite ) . expect ( "MEH: malicious input?" )
413
+ bincode:: deserialize_from ( & mut UnsafeReader :: new ( & mut data) , bincode:: Infinite ) . expect ( "MEH: malicious input?" )
375
414
} ;
376
415
377
416
AuxIter {
@@ -391,7 +430,7 @@ impl<'a, T: for<'de> Deserialize<'de>> Iterator for AuxIter<'a, T> {
391
430
} else {
392
431
self . size -= 1 ;
393
432
Some (
394
- bincode:: deserialize_from ( & mut self . data , bincode:: Infinite )
433
+ bincode:: deserialize_from ( & mut UnsafeReader :: new ( & mut self . data ) , bincode:: Infinite )
395
434
. expect ( "MEH: malicious input?" ) ,
396
435
)
397
436
}
0 commit comments