commit 92d976c3ad06d4a398d7bf95d2060e40154c39d7
author fmalita <fmalita@chromium.org> Mon Oct 05 11:09:57 2015 -0700
committer Commit bot <commit-bot@chromium.org> Mon Oct 05 11:09:58 2015 -0700
tree 265ea4bec53d2c9c827e3232acb155bfa590ba16
parent 2f5bb3abfacadc8bdbc95381ab9d4fa218994a9f

Validate text blob runs after SkTextBlob construction.

This avoids tripping CFI when casting uninitialized SkTextBlob ptrs.

BUG=chromium:538754
R=bungeman@google.com,reed@google.com,krasin@google.com

Review URL: https://codereview.chromium.org/1388543005

src/core/SkTextBlob.cpp

diff --git a/src/core/SkTextBlob.cpp b/src/core/SkTextBlob.cpp
index 68784f4..a49ff25 100644
--- a/src/core/SkTextBlob.cpp
+++ b/src/core/SkTextBlob.cpp
@@ -157,7 +157,7 @@
             + StorageSize(run->glyphCount(), run->positioning()));
     }
 
-    void validate(uint8_t* storageTop) const {
+    void validate(const uint8_t* storageTop) const {
         SkASSERT(kRunRecordMagic == fMagic);
         SkASSERT((uint8_t*)Next(this) <= storageTop);
         SkASSERT(glyphBuffer() + fCount <= (uint16_t*)posBuffer());
@@ -583,21 +583,20 @@
         fStorage.realloc(fStorageUsed);
     }
 
+    const SkTextBlob* blob = new (fStorage.detach()) SkTextBlob(fRunCount, fBounds);
+    SkDEBUGCODE(const_cast<SkTextBlob*>(blob)->fStorageSize = fStorageSize;)
+
     SkDEBUGCODE(
         size_t validateSize = sizeof(SkTextBlob);
-        const SkTextBlob::RunRecord* run =
-            SkTextBlob::RunRecord::First(reinterpret_cast<const SkTextBlob*>(fStorage.get()));
+        const SkTextBlob::RunRecord* run = SkTextBlob::RunRecord::First(blob);
         for (int i = 0; i < fRunCount; ++i) {
             validateSize += SkTextBlob::RunRecord::StorageSize(run->fCount, run->fPositioning);
-            run->validate(fStorage.get() + fStorageUsed);
+            run->validate(reinterpret_cast<const uint8_t*>(blob) + fStorageUsed);
             run = SkTextBlob::RunRecord::Next(run);
         }
         SkASSERT(validateSize == fStorageUsed);
     )
 
-    const SkTextBlob* blob = new (fStorage.detach()) SkTextBlob(fRunCount, fBounds);
-    SkDEBUGCODE(const_cast<SkTextBlob*>(blob)->fStorageSize = fStorageSize;)
-
     fStorageUsed = 0;
     fStorageSize = 0;
     fRunCount = 0;