AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

check the mask type is in range

Browse Source 
I tried fixing this before, but still had UB because I assigned
the value to the enum before checking the range. Check the range
before assigning the value to the enum.

Bug: oss-fuzz:46251

Change-Id: I7d58d67063896645d7a38453eab1c20b8489afaf
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/528881
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Herb Derby <herb@google.com>
This commit is contained in:
Herb Derby 2022-04-08 14:02:40 -06:00 committed by SkCQ
parent ae5e846047
commit 8bea0504d9
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/gpu/ganesh/text/GrTextBlob.cpp
View File

@ -247,8 +247,11 @@ static bool check_glyph_count(SkReadBuffer& buffer, int glyphCount) {
std::optional<TransformedMaskVertexFiller> TransformedMaskVertexFiller::MakeFromBuffer(
SkReadBuffer& buffer, GrSubRunAllocator* alloc) {
GrMaskFormat maskType = (GrMaskFormat)buffer.readInt();
if (!buffer.validate(maskType < kMaskFormatCount)) { return {}; }
int checkingMaskType = buffer.readInt();
if (!buffer.validate(0 <= checkingMaskType && checkingMaskType < kMaskFormatCount)) {
return {};
}
GrMaskFormat maskType = (GrMaskFormat)checkingMaskType;
int dstPadding = buffer.readInt();
if (!buffer.validate(0 <= dstPadding && dstPadding <= 2)) { return {}; }
SkScalar strikeToSourceScale = buffer.readScalar();