AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Catch width overflow

Browse Source 
BUG=chromium:662730

GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=4628

Change-Id: Iaf3a30d39fda3166a6f8fc62a30580629418dc88
Reviewed-on: https://skia-review.googlesource.com/4628
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Yuqian Li <liyuqian@google.com>
This commit is contained in:
Yuqian Li 2016-11-11 09:36:53 -05:00 committed by Skia Commit-Bot
parent b0b5360ae4
commit c4f66af20e
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/core/SkScan_AAAPath.cpp
View File

@ -153,7 +153,11 @@ public:
int getWidth() override { return fClipRect.width(); }
static bool canHandleRect(const SkIRect& bounds) {
int width = bounds.width();
// The width may overflow signed int, e.g., left = -2147483648, right = 1
unsigned width = bounds.width();
if (width > MaskAdditiveBlitter::kMAX_WIDTH) {
return false;
}
int64_t rb = SkAlign4(width);
// use 64bits to detect overflow
int64_t storage = rb * bounds.height();

15
tests/PathTest.cpp
View File

@ -4260,6 +4260,20 @@ static void test_fuzz_crbug_662952(skiatest::Reporter* reporter) {
surface->getCanvas()->drawRectCoords(0, 0, 100, 100, paint);
}
static void test_fuzz_crbug_662730(skiatest::Reporter* reporter) {
SkPath path;
path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000)); // 0, 0
path.lineTo(SkBits2Float(0xd5394437), SkBits2Float(0x37373737)); // -1.2731e+13f, 1.09205e-05f
path.lineTo(SkBits2Float(0x37373737), SkBits2Float(0x37373737)); // 1.09205e-05f, 1.09205e-05f
path.lineTo(SkBits2Float(0x37373745), SkBits2Float(0x0001b800)); // 1.09205e-05f, 1.57842e-40f
path.close();
auto surface = SkSurface::MakeRasterN32Premul(100, 100);
SkPaint paint;
paint.setAntiAlias(true);
surface->getCanvas()->drawPath(path, paint);
}
static void test_interp(skiatest::Reporter* reporter) {
SkPath p1, p2, out;
REPORTER_ASSERT(reporter, p1.isInterpolatable(p2));
@ -4315,6 +4329,7 @@ DEF_TEST(Paths, reporter) {
test_fuzz_crbug_627414(reporter);
test_path_crbug364224();
test_fuzz_crbug_662952(reporter);
test_fuzz_crbug_662730(reporter);
SkTSize<SkScalar>::Make(3,4);