limit crash small steps in 1dpatheffect
Bug: oss-fuzz:6590
Change-Id: Ib7b6f4d25712e462ca45284cf6fc8fd73aa92880
Reviewed-on: https://skia-review.googlesource.com/110640
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Mike Reed <reed@google.com>
diff --git a/src/effects/Sk1DPathEffect.cpp b/src/effects/Sk1DPathEffect.cpp
index 3c1291a..f73e076 100644
--- a/src/effects/Sk1DPathEffect.cpp
+++ b/src/effects/Sk1DPathEffect.cpp
@@ -12,13 +12,18 @@
#include "SkPathMeasure.h"
#include "SkStrokeRec.h"
+// Since we are stepping by a float, the do/while loop might go on forever (or nearly so).
+// Put in a governor to limit crash values from looping too long (and allocating too much ram).
+#define MAX_REASONABLE_ITERATIONS 100000
+
bool Sk1DPathEffect::filterPath(SkPath* dst, const SkPath& src,
SkStrokeRec*, const SkRect*) const {
SkPathMeasure meas(src, false);
do {
+ int governor = MAX_REASONABLE_ITERATIONS;
SkScalar length = meas.getLength();
SkScalar distance = this->begin(length);
- while (distance < length) {
+ while (distance < length && --governor >= 0) {
SkScalar delta = this->next(dst, distance, meas);
if (delta <= 0) {
break;