AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix overflow in rgnbuilder

Browse Source 
Bug: oss-fuzz:6956
Change-Id: I244e49d458eb78e0c6200fc3c147f0f67823f97f
Reviewed-on: https://skia-review.googlesource.com/114780
Reviewed-by: Herb Derby <herb@google.com>
Commit-Queue: Mike Reed <reed@google.com>
This commit is contained in:
Mike Reed 2018-03-16 11:09:13 -04:00 committed by Skia Commit-Bot
parent 310a2d9280
commit b5319d5e13
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/core/SkRegion_path.cpp
View File

@ -7,6 +7,7 @@
#include "SkRegionPriv.h" #include "SkRegionPriv.h"
#include "SkBlitter.h" #include "SkBlitter.h"
#include "SkSafeMath.h"
#include "SkScan.h" #include "SkScan.h"
#include "SkTSort.h" #include "SkTSort.h"
#include "SkTDArray.h" #include "SkTDArray.h"
@ -123,26 +124,28 @@ bool SkRgnBuilder::init(int maxHeight, int maxTransitions, bool pathIsInverse) {
return false; return false;
} }
SkSafeMath safe;
if (pathIsInverse) { if (pathIsInverse) {
// allow for additional X transitions to "invert" each scanline // allow for additional X transitions to "invert" each scanline
// [ L' ... normal transitions ... R' ] // [ L' ... normal transitions ... R' ]
// //
maxTransitions += 2; maxTransitions = safe.addInt(maxTransitions, 2);
} }
// compute the count with +1 and +3 slop for the working buffer // compute the count with +1 and +3 slop for the working buffer
int64_t count = sk_64_mul(maxHeight + 1, 3 + maxTransitions); size_t count = safe.mul(safe.addInt(maxHeight, 1), safe.addInt(3, maxTransitions));
if (pathIsInverse) { if (pathIsInverse) {
// allow for two "empty" rows for the top and bottom // allow for two "empty" rows for the top and bottom
// [ Y, 1, L, R, S] == 5 (*2 for top and bottom) // [ Y, 1, L, R, S] == 5 (*2 for top and bottom)
count += 10; count = safe.add(count, 10);
} }
if (count < 0 || !sk_64_isS32(count)) { if (!safe || !SkTFitsIn<int32_t>(count)) {
return false; return false;
} }
fStorageCount = sk_64_asS32(count); fStorageCount = SkToS32(count);
fStorage = (SkRegion::RunType*)sk_malloc_canfail(fStorageCount, sizeof(SkRegion::RunType)); fStorage = (SkRegion::RunType*)sk_malloc_canfail(fStorageCount, sizeof(SkRegion::RunType));
if (nullptr == fStorage) { if (nullptr == fStorage) {