Fix SkTextblob deserialization fuzzer issues
1) ../../src/core/SkTextBlob.cpp:778:27: runtime error: load of value 143, which is not a valid value for type 'bool' 2) ../../src/core/SkValidatingReadBuffer.cpp:208:16: runtime error: null pointer passed as argument 1, which is declared to never be null BUG=skia:7337 Change-Id: I1df163ad378fdd2f3e4d918eb511d9f32ff41d25 Reviewed-on: https://skia-review.googlesource.com/75380 Reviewed-by: Kevin Lubick <kjlubick@google.com> Commit-Queue: Florin Malita <fmalita@chromium.org>
This commit is contained in:
parent
2bd856ded9
commit
90dcafcc93
@ -310,14 +310,18 @@ SkTextBlob::~SkTextBlob() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
namespace {
|
namespace {
|
||||||
|
|
||||||
union PositioningAndExtended {
|
union PositioningAndExtended {
|
||||||
int32_t intValue;
|
int32_t intValue;
|
||||||
struct {
|
struct {
|
||||||
SkTextBlob::GlyphPositioning positioning;
|
SkTextBlob::GlyphPositioning positioning;
|
||||||
bool extended;
|
uint8_t extended;
|
||||||
uint16_t padding;
|
uint16_t padding;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
static_assert(sizeof(PositioningAndExtended) == sizeof(int32_t), "");
|
||||||
|
|
||||||
} // namespace
|
} // namespace
|
||||||
|
|
||||||
unsigned SkTextBlob::ScalarsPerGlyph(GlyphPositioning pos) {
|
unsigned SkTextBlob::ScalarsPerGlyph(GlyphPositioning pos) {
|
||||||
@ -806,6 +810,12 @@ sk_sp<SkTextBlob> SkTextBlob::MakeFromBuffer(SkReadBuffer& reader) {
|
|||||||
return nullptr;
|
return nullptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!buf->glyphs ||
|
||||||
|
!buf->pos ||
|
||||||
|
(pe.extended && (!buf->clusters || !buf->utf8text))) {
|
||||||
|
return nullptr;
|
||||||
|
}
|
||||||
|
|
||||||
if (!reader.readByteArray(buf->glyphs, glyphCount * sizeof(uint16_t)) ||
|
if (!reader.readByteArray(buf->glyphs, glyphCount * sizeof(uint16_t)) ||
|
||||||
!reader.readByteArray(buf->pos,
|
!reader.readByteArray(buf->pos,
|
||||||
glyphCount * sizeof(SkScalar) * ScalarsPerGlyph(pos))) {
|
glyphCount * sizeof(SkScalar) * ScalarsPerGlyph(pos))) {
|
||||||
|
Loading…
Reference in New Issue
Block a user