AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

guard against deserializing bad values for VertexFiller

Browse Source 
Bug: oss-fuzz:46251

Change-Id: I4bed79ab085860030732d29eaa674b59ea3d2808
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/526521
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Herb Derby <herb@google.com>
This commit is contained in:
Herb Derby 2022-04-01 16:44:36 -04:00 committed by SkCQ
parent 06fd22c7aa
commit 5215ec1ab9
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/gpu/text/GrTextBlob.cpp
View File

@ -248,8 +248,11 @@ static bool check_glyph_count(SkReadBuffer& buffer, int glyphCount) {
std::optional<TransformedMaskVertexFiller> TransformedMaskVertexFiller::MakeFromBuffer(
SkReadBuffer& buffer, GrSubRunAllocator* alloc) {
GrMaskFormat maskType = (GrMaskFormat)buffer.readInt();
if (!buffer.validate(maskType < kMaskFormatCount)) { return {}; }
int dstPadding = buffer.readInt();
if (!buffer.validate(0 <= dstPadding && dstPadding <= 2)) { return {}; }
SkScalar strikeToSourceScale = buffer.readScalar();
if (!buffer.validate(0 < strikeToSourceScale)) { return {}; }
SkRect sourceBounds = buffer.readRect();
int glyphCount = buffer.readInt();