AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Revert "SkRegion: more robust validation"

Browse Source 
This reverts commit 711450e948.

Reason for revert: speculative revert to fix chrome roll.

Original change's description:
> SkRegion: more robust validation
> 
> BUG=oss-fuzz:1864
> Change-Id: I4c3d3c4c7b0717399fe16f227e032682b13ebc74
> Reviewed-on: https://skia-review.googlesource.com/20322
> Reviewed-by: Cary Clark <caryclark@google.com>
> Commit-Queue: Hal Canary <halcanary@google.com>

TBR=halcanary@google.com,caryclark@google.com,reed@google.com

Change-Id: I95cbbf064db6ea7ef74a757bca058ba8de20d87b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: oss-fuzz:1864
Reviewed-on: https://skia-review.googlesource.com/20452
Reviewed-by: Hal Canary <halcanary@google.com>
Commit-Queue: Hal Canary <halcanary@google.com>
This commit is contained in:
Hal Canary 2017-06-21 19:57:09 +00:00 committed by Skia Commit-Bot
parent b29dd819c9
commit 7f4124058e
2 changed files with 1 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/core/SkRegion.cpp
View File

@ -1155,9 +1155,6 @@ static bool validate_run(const int32_t* runs,
if (rect.fTop == SkRegion::kRunTypeSentinel) {
return false; // no rect can contain SkRegion::kRunTypeSentinel
}
if (rect.fTop != givenBounds.fTop) {
return false; // Must not begin with empty span that does not contribute to bounds.
}
do {
--ySpanCount;
if (ySpanCount < 0) {
@ -1167,13 +1164,6 @@ static bool validate_run(const int32_t* runs,
if (rect.fBottom == SkRegion::kRunTypeSentinel) {
return false;
}
if (rect.fBottom > givenBounds.fBottom) {
return false; // Must not end with empty span that does not contribute to bounds.
}
if (rect.fBottom <= rect.fTop) {
return false; // y-intervals must be ordered; rects must be non-empty.
}
int32_t xIntervals = *runs++;
SkASSERT(runs < end);
if (xIntervals < 0 || runs + 1 + 2 * xIntervals > end) {
@ -1183,19 +1173,13 @@ static bool validate_run(const int32_t* runs,
if (intervalCount < 0) {
return false; // too many intervals
}
bool firstInterval = true;
int32_t lastRight; // check that x-intervals are distinct and ordered.
while (xIntervals-- > 0) {
rect.fLeft = *runs++;
rect.fRight = *runs++;
if (rect.fLeft == SkRegion::kRunTypeSentinel ||
rect.fRight == SkRegion::kRunTypeSentinel ||
rect.fLeft >= rect.fRight || // check non-empty rect
(!firstInterval && rect.fLeft <= lastRight)) {
rect.fRight == SkRegion::kRunTypeSentinel || rect.isEmpty()) {
return false;
}
lastRight = rect.fRight;
firstInterval = false;
bounds.join(rect);
}
if (*runs++ != SkRegion::kRunTypeSentinel) {

32
tests/RegionTest.cpp
View File

@ -327,13 +327,6 @@ DEF_TEST(Region_readFromMemory_bad, r) {
2147483647, 2147483647};
REPORTER_ASSERT(r, 0 != region.readFromMemory(data, sizeof(data)));
}
{
// Example of valid data with 4 intervals
int32_t data[] = {19, 0, 0, 30, 30, 3, 4, 0, 10, 2, 0, 10, 20, 30,
2147483647, 20, 0, 2147483647, 30, 2, 0, 10, 20, 30,
2147483647, 2147483647};
REPORTER_ASSERT(r, 0 != region.readFromMemory(data, sizeof(data)));
}
{
// Short count
int32_t data[] = {8, 0, 0, 10, 10, 1, 2, 0, 10, 2, 0, 4, 6, 10,
@ -370,29 +363,4 @@ DEF_TEST(Region_readFromMemory_bad, r) {
-1, 2147483647};
REPORTER_ASSERT(r, 0 == region.readFromMemory(data, sizeof(data)));
}
{
// starts with empty yspan
int32_t data[] = {12, 0, 0, 10, 10, 2, 2, -5, 0, 0, 2147483647, 10,
2, 0, 4, 6, 10, 2147483647, 2147483647};
REPORTER_ASSERT(r, 0 == region.readFromMemory(data, sizeof(data)));
}
{
// ends with empty yspan
int32_t data[] = {12, 0, 0, 10, 10, 2, 2, 0, 10, 2, 0, 4, 6, 10,
2147483647, 15, 0, 2147483647, 2147483647};
REPORTER_ASSERT(r, 0 == region.readFromMemory(data, sizeof(data)));
}
{
// y intervals out of order
int32_t data[] = {19, 0, -20, 30, 10, 3, 4, 0, 10, 2, 0, 10, 20, 30,
2147483647, -20, 0, 2147483647, -10, 2, 0, 10, 20, 30,
2147483647, 2147483647};
REPORTER_ASSERT(r, 0 == region.readFromMemory(data, sizeof(data)));
}
{
// x intervals out of order
int32_t data[] = {9, 0, 0, 10, 10, 1, 2, 0, 10, 2, 6, 10, 0, 4,
2147483647, 2147483647};
REPORTER_ASSERT(r, 0 == region.readFromMemory(data, sizeof(data)));
}
}