commit d589916ebc418acad24c576fd12d21d798d82508
author Florin Malita <fmalita@chromium.org> Tue Feb 04 10:06:24 2020 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue Feb 04 15:31:30 2020 +0000
tree 2e089e3ea219306997b9924be926d3c5bff2cc65
parent 4bcab23423a7bd1e5e805e6f5abab8cbeafc6967

Potentially-uninitialized Sk3LookAt result

Bug: oss-fuzz:20520
Change-Id: I383881571fa156c6faa5e798a1e126bb9e5e8dd0
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/268621
Commit-Queue: Florin Malita <fmalita@chromium.org>
Reviewed-by: Mike Reed <reed@google.com>

gm/3d.cpp

diff --git a/gm/3d.cpp b/gm/3d.cpp
index c1b7c11..cbc664f 100644
--- a/gm/3d.cpp
+++ b/gm/3d.cpp
@@ -19,8 +19,10 @@
 };
 
 static SkM44 inv(const SkM44& m) {
-    SkM44 inverse;
-    m.invert(&inverse);
+    SkM44 inverse(SkM44::kUninitialized_Constructor);
+    if (!m.invert(&inverse)) {
+        inverse.setIdentity();
+    }
     return inverse;
 }
 

include/private/SkM44.h

diff --git a/include/private/SkM44.h b/include/private/SkM44.h
index 3c654e7..1623e6f 100644
--- a/include/private/SkM44.h
+++ b/include/private/SkM44.h
@@ -287,7 +287,7 @@
     /** If this is invertible, return that in inverse and return true. If it is
      *  not invertible, return false and leave the inverse parameter unchanged.
      */
-    bool invert(SkM44* inverse) const;
+    bool SK_WARN_UNUSED_RESULT invert(SkM44* inverse) const;
 
     SkM44 transpose() const;
 

samplecode/Sample3D.cpp

diff --git a/samplecode/Sample3D.cpp b/samplecode/Sample3D.cpp
index 6e6305b..5bee8c2 100644
--- a/samplecode/Sample3D.cpp
+++ b/samplecode/Sample3D.cpp
@@ -183,8 +183,10 @@
 };
 
 static bool front(const SkM44& m) {
-    SkM44 m2;
-    m.invert(&m2);
+    SkM44 m2(SkM44::kUninitialized_Constructor);
+    if (!m.invert(&m2)) {
+        m2.setIdentity();
+    }
     /*
      *  Classically we want to dot the transpose(inverse(ctm)) with our surface normal.
      *  In this case, the normal is known to be {0, 0, 1}, so we only actually need to look

src/core/SkM44.cpp

diff --git a/src/core/SkM44.cpp b/src/core/SkM44.cpp
index 2c82a0a..d0a6974 100644
--- a/src/core/SkM44.cpp
+++ b/src/core/SkM44.cpp
@@ -296,7 +296,9 @@
     SkV3 s = normalize(f.cross(u));
 
     SkM44 m(SkM44::kUninitialized_Constructor);
-    (void)SkM44::Cols(v4(s, 0), v4(s.cross(f), 0), v4(-f, 0), v4(eye, 1)).invert(&m);
+    if (!SkM44::Cols(v4(s, 0), v4(s.cross(f), 0), v4(-f, 0), v4(eye, 1)).invert(&m)) {
+        m.setIdentity();
+    }
     return m;
 }