commit b6cce2d4c7466d54f3d7e57abefd65cfe8ffeb99
author Herb Derby <herb@google.com> Mon May 03 10:46:47 2021 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Mon May 03 19:27:54 2021 +0000
tree 83869387dfef566b46a4842d54ae569dfb12fa95
parent 4ecc0f43f243ef286ac47f2db0d6cc1c7ab687f4

don't draw strings that have no glyphs

This string had several characters which resulted in zero
glyphs. Having zero glyphs bypassed the buffer sizing code,
and continued to process the glyph run list assuming it had
7 runs because the buffer sizing code also clears the run list.
This caused the code to process runs from a previous SkTextBlob,
which was already deleted.

If the there are no glyphs, call the buffer sizing code to
set up all the invariants. Exit if there are no runs produced.

Bug: oss-fuzz:33915

Change-Id: I9f3f38a58112c44ddd65265c68d982b3b0dcd79c
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/403439
Reviewed-by: Ben Wagner <bungeman@google.com>
Commit-Queue: Herb Derby <herb@google.com>

src/core/SkCanvas.cpp

diff --git a/src/core/SkCanvas.cpp b/src/core/SkCanvas.cpp
index 9ec49d0..aec582a 100644
--- a/src/core/SkCanvas.cpp
+++ b/src/core/SkCanvas.cpp
@@ -2279,7 +2279,9 @@
         const SkGlyphRunList& glyphRunList =
             fScratchGlyphRunBuilder->textToGlyphRunList(
                     font, paint, text, byteLength, {x, y}, encoding);
-        this->onDrawGlyphRunList(glyphRunList, paint);
+        if (!glyphRunList.empty()) {
+            this->onDrawGlyphRunList(glyphRunList, paint);
+        }
     }
 }
 

src/core/SkGlyphRun.cpp

diff --git a/src/core/SkGlyphRun.cpp b/src/core/SkGlyphRun.cpp
index 1256f19..af8b8e4 100644
--- a/src/core/SkGlyphRun.cpp
+++ b/src/core/SkGlyphRun.cpp
@@ -193,8 +193,8 @@
         SkTextEncoding encoding) {
     auto glyphIDs = textToGlyphIDs(font, bytes, byteLength, encoding);
     SkRect bounds = SkRect::MakeEmpty();
+    this->prepareBuffers(glyphIDs.size(), 0);
     if (!glyphIDs.empty()) {
-        this->prepareBuffers(glyphIDs.size(), 0);
         SkSpan<const SkPoint> positions = draw_text_positions(font, glyphIDs, {0, 0}, fPositions);
         this->makeGlyphRun(font,
                            glyphIDs,

tests/DrawTextTest.cpp

diff --git a/tests/DrawTextTest.cpp b/tests/DrawTextTest.cpp
index 3f4c9ab..981b6f6 100644
--- a/tests/DrawTextTest.cpp
+++ b/tests/DrawTextTest.cpp
@@ -17,6 +17,7 @@
 #include "include/core/SkRefCnt.h"
 #include "include/core/SkScalar.h"
 #include "include/core/SkSurface.h"
+#include "include/core/SkTextBlob.h"
 #include "include/core/SkTypeface.h"
 #include "include/core/SkTypes.h"
 #include "include/effects/SkDashPathEffect.h"
@@ -161,3 +162,19 @@
         canvas->drawString("Hamburgefons", 10, 10, font, SkPaint());
     }
 }
+
+// This produces no glyphs, and is to check that buffers from previous draws don't get
+// reused.
+DEF_TEST(DrawText_noglyphs, r) {
+    auto surface = SkSurface::MakeRasterN32Premul(100,100);
+    auto canvas = surface->getCanvas();
+    auto text = "Hamburgfons";
+    {
+        // scoped to ensure blob is deleted.
+        auto blob = SkTextBlob::MakeFromText(text, strlen(text), SkFont());
+        canvas->drawTextBlob(blob, 10, 10, SkPaint());
+    }
+    canvas->drawString(
+            "\x0d\xf3\xf2\xf2\xe9\x0d\x0d\x0d\x05\x0d\x0d\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3\xe3",
+            10, 20, SkFont(), SkPaint());
+}