commit 6a4077f5dfaef6f3498a9a54c9dbcef4f6662f9d
author John Stiles <johnstiles@google.com> Fri Nov 24 09:40:11 2023 -0500
committer SkCQ <skcq-be@skia-corp.google.com.iam.gserviceaccount.com> Mon Dec 04 22:53:12 2023 +0000
tree 4930fe45fdfdb28de3a43ad42259e136827cc566
parent 33502f9b0c7d845adceb4907d1c7dc1f22b3fd4c

Avoid combining extremely large meshes.

Bug: chromium:1505053
Change-Id: I42f2ff872bbf054686ec7af0cc85ff63055fcfbf
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/782936
Commit-Queue: Michael Ludwig <michaelludwig@google.com>
Reviewed-by: Michael Ludwig <michaelludwig@google.com>
Auto-Submit: John Stiles <johnstiles@google.com>
(cherry picked from commit 6169a1fabae1743709bc9641ad43fcbb6a4f62e1)
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/786117
Reviewed-by: John Stiles <johnstiles@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Heather Miller <hcm@google.com>
Reviewed-by: Heather Miller <hcm@google.com>
Owners-Override: Heather Miller <hcm@google.com>

src/gpu/ganesh/ops/DrawMeshOp.cpp

diff --git a/src/gpu/ganesh/ops/DrawMeshOp.cpp b/src/gpu/ganesh/ops/DrawMeshOp.cpp
index aa6b0f3..34dfd1d 100644
--- a/src/gpu/ganesh/ops/DrawMeshOp.cpp
+++ b/src/gpu/ganesh/ops/DrawMeshOp.cpp
@@ -1031,10 +1031,13 @@
         return CombineResult::kCannotCombine;
     }
 
+    if (fVertexCount > INT32_MAX - that->fVertexCount) {
+        return CombineResult::kCannotCombine;
+    }
     if (SkToBool(fIndexCount) != SkToBool(that->fIndexCount)) {
         return CombineResult::kCannotCombine;
     }
-    if (SkToBool(fIndexCount) && fVertexCount + that->fVertexCount > SkToInt(UINT16_MAX)) {
+    if (SkToBool(fIndexCount) && fVertexCount > UINT16_MAX - that->fVertexCount) {
         return CombineResult::kCannotCombine;
     }