commit 6169a1fabae1743709bc9641ad43fcbb6a4f62e1
author John Stiles <johnstiles@google.com> Fri Nov 24 09:40:11 2023 -0500
committer SkCQ <skcq-be@skia-corp.google.com.iam.gserviceaccount.com> Fri Nov 24 15:54:30 2023 +0000
tree 7e37bb50096f0b7bd2ff305c49d3e02b49b77911
parent b18b594b230db2df150ab4f96b82313a59f24f1e

Avoid combining extremely large meshes.

Bug: chromium:1505053
Change-Id: I42f2ff872bbf054686ec7af0cc85ff63055fcfbf
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/782936
Commit-Queue: Michael Ludwig <michaelludwig@google.com>
Reviewed-by: Michael Ludwig <michaelludwig@google.com>
Auto-Submit: John Stiles <johnstiles@google.com>

src/gpu/ganesh/ops/DrawMeshOp.cpp

diff --git a/src/gpu/ganesh/ops/DrawMeshOp.cpp b/src/gpu/ganesh/ops/DrawMeshOp.cpp
index d827009..eed2757 100644
--- a/src/gpu/ganesh/ops/DrawMeshOp.cpp
+++ b/src/gpu/ganesh/ops/DrawMeshOp.cpp
@@ -1178,10 +1178,13 @@
         return CombineResult::kCannotCombine;
     }
 
+    if (fVertexCount > INT32_MAX - that->fVertexCount) {
+        return CombineResult::kCannotCombine;
+    }
     if (SkToBool(fIndexCount) != SkToBool(that->fIndexCount)) {
         return CombineResult::kCannotCombine;
     }
-    if (SkToBool(fIndexCount) && fVertexCount + that->fVertexCount > SkToInt(UINT16_MAX)) {
+    if (SkToBool(fIndexCount) && fVertexCount > UINT16_MAX - that->fVertexCount) {
         return CombineResult::kCannotCombine;
     }