AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

don't walk off end of pointer

Browse Source 
Avoids pointer-overflow in ASAN/UBSAN.

R=mtklein@google.com

Bug:836282
Change-Id: I2125fa7927c30ae601431af8daec0f900c84799c
Reviewed-on: https://skia-review.googlesource.com/131261
Auto-Submit: Cary Clark <caryclark@skia.org>
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Mike Klein <mtklein@google.com>
This commit is contained in:
Cary Clark 2018-05-31 16:22:02 -04:00 committed by Skia Commit-Bot
parent b4a8a62940
commit 79aa2f12ab
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/pathops/SkOpEdgeBuilder.cpp
View File

@ -175,10 +175,11 @@ bool SkOpEdgeBuilder::close() {
bool SkOpEdgeBuilder::walk() { bool SkOpEdgeBuilder::walk() {
uint8_t* verbPtr = fPathVerbs.begin(); uint8_t* verbPtr = fPathVerbs.begin();
uint8_t* endOfFirstHalf = &verbPtr[fSecondHalf]; uint8_t* endOfFirstHalf = &verbPtr[fSecondHalf];
SkPoint* pointsPtr = fPathPts.begin() - 1; SkPoint* pointsPtr = fPathPts.begin();
SkScalar* weightPtr = fWeights.begin(); SkScalar* weightPtr = fWeights.begin();
SkPath::Verb verb; SkPath::Verb verb;
SkOpContour* contour = fContourBuilder.contour(); SkOpContour* contour = fContourBuilder.contour();
int moveToPtrBump = 0;
while ((verb = (SkPath::Verb) *verbPtr) != SkPath::kDone_Verb) { while ((verb = (SkPath::Verb) *verbPtr) != SkPath::kDone_Verb) {
if (verbPtr == endOfFirstHalf) { if (verbPtr == endOfFirstHalf) {
fOperand = true; fOperand = true;
@ -198,7 +199,8 @@ bool SkOpEdgeBuilder::walk() {
} }
contour->init(fGlobalState, fOperand, contour->init(fGlobalState, fOperand,
fXorMask[fOperand] == kEvenOdd_PathOpsMask); fXorMask[fOperand] == kEvenOdd_PathOpsMask);
pointsPtr += 1; pointsPtr += moveToPtrBump;
moveToPtrBump = 1;
continue; continue;
case SkPath::kLine_Verb: case SkPath::kLine_Verb:
fContourBuilder.addLine(pointsPtr); fContourBuilder.addLine(pointsPtr);