From 430ad1f2065c182746e43e67ca95fb911cc55892 Mon Sep 17 00:00:00 2001 From: Jim Van Verth Date: Thu, 2 Nov 2017 12:09:55 -0400 Subject: [PATCH] Fix int overflow issues with clip and path bounds, take 2. * Change IsInsideClip test to be more int overflow friendly * Check to make sure path bounds can have representable width and height Bug: skia:7239 Bug: skia:7240 Change-Id: If8468e46bc74a428c25d466ff3756d0cad385c09 Reviewed-on: https://skia-review.googlesource.com/66154 Reviewed-by: Brian Salomon Commit-Queue: Jim Van Verth --- src/gpu/GrClip.h | 4 ++-- src/gpu/GrSoftwarePathRenderer.cpp | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/gpu/GrClip.h b/src/gpu/GrClip.h index 2e247c82f2..bd7d8a1d96 100644 --- a/src/gpu/GrClip.h +++ b/src/gpu/GrClip.h @@ -74,8 +74,8 @@ public: */ template constexpr static bool IsInsideClip(const TRect& innerClipBounds, const SkRect& queryBounds) { - return innerClipBounds.fRight - innerClipBounds.fLeft > kBoundsTolerance && - innerClipBounds.fBottom - innerClipBounds.fTop > kBoundsTolerance && + return innerClipBounds.fRight > innerClipBounds.fLeft + kBoundsTolerance && + innerClipBounds.fBottom > innerClipBounds.fTop + kBoundsTolerance && innerClipBounds.fLeft < queryBounds.fLeft + kBoundsTolerance && innerClipBounds.fTop < queryBounds.fTop + kBoundsTolerance && innerClipBounds.fRight > queryBounds.fRight - kBoundsTolerance && diff --git a/src/gpu/GrSoftwarePathRenderer.cpp b/src/gpu/GrSoftwarePathRenderer.cpp index 4b0f363fee..ef7fa9078e 100644 --- a/src/gpu/GrSoftwarePathRenderer.cpp +++ b/src/gpu/GrSoftwarePathRenderer.cpp @@ -52,6 +52,11 @@ static bool get_unclipped_shape_dev_bounds(const GrShape& shape, const SkMatrix& if (!shapeDevBounds.intersect(SkRect::MakeLTRB(INT32_MIN, INT32_MIN, kMaxInt, kMaxInt))) { return false; } + // Make sure that the resulting SkIRect can have representable width and height + if (SkScalarRoundToInt(shapeDevBounds.width()) > kMaxInt || + SkScalarRoundToInt(shapeDevBounds.height()) > kMaxInt) { + return false; + } shapeDevBounds.roundOut(devBounds); return true; }