AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

abort if glyph metrics fall outside safe rect

Browse Source 
Caught this while debugging a fuzz from Kevin.

Haven't seen this on Windows, but seems like it's got roughly the same
possible issue.

Change-Id: I5e1c7328890492b3f3295af27757e456e26f9cbf
Reviewed-on: https://skia-review.googlesource.com/55760
Reviewed-by: Ben Wagner <bungeman@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
This commit is contained in:
Mike Klein 2017-10-05 11:40:57 -04:00 committed by Skia Commit-Bot
parent 2ba7f3a26c
commit d94e00c985
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/ports/SkFontHost_mac.cpp
View File

@ -1035,6 +1035,12 @@ void SkScalerContext_Mac::generateMetrics(SkGlyph* glyph) {
skBounds.fBottom += SkFixedToFloat(glyph->getSubYFixed());
}
// We're trying to pack left and top into int16_t,
// and width and height into uint16_t, after outsetting by 1.
if (!SkRect::MakeXYWH(-32767, -32767, 65535, 65535).contains(skBounds)) {
return;
}
SkIRect skIBounds;
skBounds.roundOut(&skIBounds);
// Expand the bounds by 1 pixel, to give CG room for anti-aliasing.

8
src/ports/SkScalerContext_win_dw.cpp
View File

@ -505,6 +505,14 @@ static bool glyph_check_and_set_bounds(SkGlyph* glyph, const RECT& bbox) {
if (bbox.left >= bbox.right || bbox.top >= bbox.bottom) {
return false;
}
// We're trying to pack left and top into int16_t,
// and width and height into uint16_t, after outsetting by 1.
if (!SkIRect::MakeXYWH(-32767, -32767, 65535, 65535).contains(
SkIRect::MakeLTRB(bbox.left, bbox.top, bbox.right, bbox.bottom))) {
return false;
}
glyph->fWidth = SkToU16(bbox.right - bbox.left);
glyph->fHeight = SkToU16(bbox.bottom - bbox.top);
glyph->fLeft = SkToS16(bbox.left);