commit 27575e881ed68ee306d53e94a070c38c5d81e2a6
author Mike Reed <reed@google.com> Thu May 17 10:11:31 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu May 17 15:11:13 2018 +0000
tree 56e6ed6839e3fc1934010583633195c11839ff1a
parent d2152c4cde9faa06d41f7aa9ced838e82918e7ee

check path bounds before trying to shadow

Bug: oss-fuzz:8331
Change-Id: Idbff0deb0b9968edf4b4fafd4cf497bbb71c64fa
Reviewed-on: https://skia-review.googlesource.com/128550
Reviewed-by: Jim Van Verth <jvanverth@google.com>
Commit-Queue: Mike Reed <reed@google.com>

src/utils/SkShadowTessellator.cpp

diff --git a/src/utils/SkShadowTessellator.cpp b/src/utils/SkShadowTessellator.cpp
index ee2375e..c377579 100755
--- a/src/utils/SkShadowTessellator.cpp
+++ b/src/utils/SkShadowTessellator.cpp
@@ -1046,7 +1046,7 @@
         fCentroid.fX += (currPoint.fX + nextPoint.fX) * quadArea;
         fCentroid.fY += (currPoint.fY + nextPoint.fY) * quadArea;
         fArea += quadArea;
-        fCentroid *= SK_Scalar1 / (3 * fArea);
+        fCentroid *= sk_ieee_float_divide(1, 3 * fArea);
     }
 
     fCurrClipPoint = fClipPolygon.count() - 1;
@@ -1576,7 +1576,7 @@
 
 sk_sp<SkVertices> SkShadowTessellator::MakeAmbient(const SkPath& path, const SkMatrix& ctm,
                                                    const SkPoint3& zPlane, bool transparent) {
-    if (!path.isFinite() || !ctm.isFinite() || !zPlane.isFinite()) {
+    if (!ctm.mapRect(path.getBounds()).isFinite() || !zPlane.isFinite()) {
         return nullptr;
     }
     SkAmbientShadowTessellator ambientTess(path, ctm, zPlane, transparent);
@@ -1586,7 +1586,7 @@
 sk_sp<SkVertices> SkShadowTessellator::MakeSpot(const SkPath& path, const SkMatrix& ctm,
                                                 const SkPoint3& zPlane, const SkPoint3& lightPos,
                                                 SkScalar lightRadius,  bool transparent) {
-    if (!path.isFinite() || !ctm.isFinite() || !zPlane.isFinite() ||
+    if (!ctm.mapRect(path.getBounds()).isFinite() || !zPlane.isFinite() ||
         !lightPos.isFinite() || !SkScalarIsFinite(lightRadius) || !(lightRadius > 0)) {
         return nullptr;
     }