tree 9007398123c441f7d5b2e245b3fe4e08bda1bc8b
parent f4bd5f148c150c7ffe73bdf1aa6f9d565c0c2125
author Khushal <khushalsagar@chromium.org> 1534464611 -0700
committer Khusal Sagar <khushalsagar@chromium.org> 1534899928 +0000

fonts: Fix UAF bug in SkRemoteGlyphCache.

No reference to memory allocated from the serializer should be retained
after another allocation is made, since the vector can internally
realloc. In the case where a glyph is tooLargeForAtlas, we serialize the
path and still access the glyph after it, which could result in a UAF
bug.

R=​mtklein@google.com

Bug: 874740
Change-Id: I33c048c154e53b89d68acd02d68718d7ec7b2388
Reviewed-on: https://skia-review.googlesource.com/147824
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Mike Klein <mtklein@google.com>
(cherry picked from commit 40adb3c41f2a02693becbc90fddd512406118ced)
Reviewed-on: https://skia-review.googlesource.com/148500
Reviewed-by: Khushal Sagar <khushalsagar@google.com>
Reviewed-by: Khusal Sagar <khushalsagar@chromium.org>