AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Revert "Revert "reject large paths to avoid potential float overflows""

Browse Source 
This reverts commit b8f0709aac.

Attempted fix: update the iData before we return.

Bug: oss-fuzz:8131

Change-Id: If60b8b45df4dcb1deecc18f58cb09644aaa3231d
Reviewed-on: https://skia-review.googlesource.com/127501
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Mike Reed <reed@google.com>
This commit is contained in:
Mike Reed 2018-05-11 17:10:40 -04:00 committed by Skia Commit-Bot
parent e6bbae787d
commit 3202ac4d24
2 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/core/SkDraw.cpp
View File

@ -951,6 +951,12 @@ SkScalar SkDraw::ComputeResScaleForStroking(const SkMatrix& matrix) {
void SkDraw::drawDevPath(const SkPath& devPath, const SkPaint& paint, bool drawCoverage,
SkBlitter* customBlitter, bool doFill, SkInitOnceData* iData) const {
if (SkPathPriv::TooBigForMath(devPath)) {
if (iData) {
iData->setEmptyDrawFn();
}
return;
}
SkBlitter* blitter = nullptr;
SkAutoBlitterChoose blitterStorage;
if (nullptr == customBlitter) {

22
src/core/SkPathPriv.h
View File

@ -222,6 +222,28 @@ public:
static bool IsBadForDAA(const SkPath& path) { return path.fIsBadForDAA; }
static void SetIsBadForDAA(SkPath& path, bool isBadForDAA) { path.fIsBadForDAA = isBadForDAA; }
/**
* Sometimes in the drawing pipeline, we have to perform math on path coordinates, even after
* the path is in device-coordinates. Tessellation and clipping are two examples. Usually this
* is pretty modest, but it can involve subtracting/adding coordinates, or multiplying by
* small constants (e.g. 2,3,4). To try to preflight issues where these optionations could turn
* finite path values into infinities (or NaNs), we allow the upper drawing code to reject
* the path if its bounds (in device coordinates) is too close to max float.
*/
static bool TooBigForMath(const SkRect& bounds) {
// This value is just a guess. smaller is safer, but we don't want to reject largish paths
// that we don't have to.
constexpr SkScalar scale_down_to_allow_for_small_multiplies = 0.25f;
constexpr SkScalar max = SK_ScalarMax * scale_down_to_allow_for_small_multiplies;
// use ! expression so we return true if bounds contains NaN
return !(bounds.fLeft >= -max && bounds.fTop >= -max &&
bounds.fRight <= max && bounds.fBottom <= max);
}
static bool TooBigForMath(const SkPath& path) {
return TooBigForMath(path.getBounds());
}
// Returns number of valid points for each SkPath::Iter verb
static int PtsInIter(unsigned verb) {
static const uint8_t gPtsInVerb[] = {