AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

SkColorSpaceXform: clamp before table lookups

Browse Source 
The fuzzer has built a single test case that causes out-of-bounds
reads on both the src and dst tables.  I'm glad we have it.

Next follow ups may include:
    - have byte_tables_rgb do its own clamping
    - replace table_{r,g,b} here with a single stage analogous
      to byte_tables_rgb that looks up the three float tables
      safely
    - maybe replace byte_tables_rgb with that.  I'm not really
      sure why src->XYZ tables are floats but XYZ->dst are bytes.

I'm going to try some of these out before attempting to reland
in Chrome.  As usual, rebaselining Blink makes things a pain.

Bug: chromium:772684, skia:7114
Change-Id: Id8759e766330e1c7689c0847bf2cd35d422ebbcd
Reviewed-on: https://skia-review.googlesource.com/57760
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
This commit is contained in:
Mike Klein 2017-10-10 11:30:10 -04:00 committed by Skia Commit-Bot
parent 1a3457d3fc
commit 24f0a354ac
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/SkColorSpaceXform.cpp
View File

@ -611,7 +611,9 @@ bool SkColorSpaceXform_XYZ::onApply(ColorFormat dstColorFormat, void* dst,
switch (fSrcGamma) {
case kLinear_SrcGamma: break;
case kSRGB_SrcGamma: pipeline.append_from_srgb(kUnpremul_SkAlphaType); break;
case kTable_SrcGamma: pipeline.append(SkRasterPipeline::table_r, &table_r);
case kTable_SrcGamma: pipeline.append(SkRasterPipeline::clamp_0);
pipeline.append(SkRasterPipeline::clamp_1);
pipeline.append(SkRasterPipeline::table_r, &table_r);
pipeline.append(SkRasterPipeline::table_g, &table_g);
pipeline.append(SkRasterPipeline::table_b, &table_b); break;
}
@ -642,7 +644,9 @@ bool SkColorSpaceXform_XYZ::onApply(ColorFormat dstColorFormat, void* dst,
case kLinear_DstGamma: break;
case kSRGB_DstGamma: pipeline.append(SkRasterPipeline::to_srgb); break;
case k2Dot2_DstGamma: pipeline.append(SkRasterPipeline::gamma, &to_2dot2); break;
case kTable_DstGamma: pipeline.append(SkRasterPipeline::byte_tables_rgb, &tables); break;
case kTable_DstGamma: pipeline.append(SkRasterPipeline::clamp_0);
pipeline.append(SkRasterPipeline::clamp_1);
pipeline.append(SkRasterPipeline::byte_tables_rgb, &tables); break;
}
if (kPremul_SkAlphaType == alphaType && SkTransferFunctionBehavior::kIgnore == fPremulBehavior)
{