commit 296de50b4c2e31f94b8c3fafae8fcd7bcfb00e0b
author Brian Salomon <bsalomon@google.com> Tue Mar 13 12:26:55 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue Mar 13 17:42:32 2018 +0000
tree 318f9eab9b55f608683f01ef5e45f08ca2d0fd9a
parent 98ad5b7a4bcab3cb9a9bcd2e1a63976133515806

Fix possible overflows in hair line path renderer vertex counts

Bug: chromium:820913
Change-Id: I77f9b40cf6173369a4a1b943d71734c305893e09
Reviewed-on: https://skia-review.googlesource.com/114140
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Brian Salomon <bsalomon@google.com>

src/gpu/ops/GrAAHairLinePathRenderer.cpp

diff --git a/src/gpu/ops/GrAAHairLinePathRenderer.cpp b/src/gpu/ops/GrAAHairLinePathRenderer.cpp
index 2342982..a463c89 100644
--- a/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+++ b/src/gpu/ops/GrAAHairLinePathRenderer.cpp
@@ -933,6 +933,13 @@
 
     int lineCount = lines.count() / 2;
     int conicCount = conics.count() / 3;
+    int quadAndConicCount = conicCount + quadCount;
+
+    static constexpr int kMaxLines = SK_MaxS32 / kLineSegNumVertices;
+    static constexpr int kMaxQuadsAndConics = SK_MaxS32 / kQuadNumVertices;
+    if (lineCount > kMaxLines || quadAndConicCount > kMaxQuadsAndConics) {
+        return;
+    }
 
     const GrPipeline* pipeline = fHelper.makePipeline(target);
     // do lines first
@@ -1000,7 +1007,7 @@
         sk_sp<const GrBuffer> quadsIndexBuffer = get_quads_index_buffer(target->resourceProvider());
 
         size_t vertexStride = sizeof(BezierVertex);
-        int vertexCount = kQuadNumVertices * quadCount + kQuadNumVertices * conicCount;
+        int vertexCount = kQuadNumVertices * quadAndConicCount;
         void *vertices = target->makeVertexSpace(vertexStride, vertexCount,
                                                  &vertexBuffer, &firstVertex);