commit 297aaf97a32ac16a2bc3f4bbc231d5de859ac02d
author kkinnunen <kkinnunen@nvidia.com> Thu Feb 19 06:32:12 2015 -0800
committer Commit bot <commit-bot@chromium.org> Thu Feb 19 06:32:12 2015 -0800
tree f0166b204555a6137b31c4cbc89fb4c4cd47e0f2
parent f421ec6cc9c8f32d717b9b1df71fd9e79817a16c

Avoid wrong memory access due to double substitution and %%

Use the form SkDebugf("%s", arbitraryString) instead of
SkDebugf(arbitraryString).

Fixes the case where SkString::appendf-ing a string with "%%" and then
printing the string with SkDebugf would cause uninitialized read and
corrupted debug print.

ninja -C out/Debug tools && valgrind --leak-check=full
./out/Debug/render_pictures --config gpu  -w q -r ...

...

==7307== Conditional jump or move depends on uninitialised value(s)
==7307==    at 0x6908475: __printf_fp (printf_fp.c:1180)
==7307==    by 0x6904267: vfprintf (vfprintf.c:1629)
==7307==    by 0x6906E53: buffered_vfprintf (vfprintf.c:2313)
==7307==    by 0x690188D: vfprintf (vfprintf.c:1316)
==7307==    by 0x67E8F5: SkDebugf(char const*, ...) (SkDebug_stdio.cpp:18)
==7307==    by 0x7983F1: GrContext::printCacheStats() const (GrTest.cpp:54)
==7307==    by 0x408ECF: tool_main(int, char**) (render_pictures_main.cpp:480)
==7307==    by 0x40913E: main (render_pictures_main.cpp:511)
==7307==
Budget: 2048 items 100663296 bytes
		Entry Count: current 652 (651 budgeted, 0 wrapped, 297 locked, 638 scratch 32 0.000000ull), high 652
		Entry Bytes: current 51087658 (budgeted 49826658, 49 0.000000ull, 1261000 unbudgeted) high 51087658

(observe "ull" instead of "% full")

(from mtklein)
This CL is not editing public API.
TBR=reed@google.com

Review URL: https://codereview.chromium.org/943453002

tests/PathOpsExtendedTest.cpp

diff --git a/tests/PathOpsExtendedTest.cpp b/tests/PathOpsExtendedTest.cpp
index 73a2387..e0d30ba 100644
--- a/tests/PathOpsExtendedTest.cpp
+++ b/tests/PathOpsExtendedTest.cpp
@@ -443,7 +443,7 @@
         }
         const char testFunction[] = "testSimplify(reporter, path);";
         outputToStream(pathStr, pathPrefix, nameSuffix, testFunction, false, stream);
-        SkDebugf(temp);
+        SkDebugf("%s", temp);
         REPORTER_ASSERT(state.fReporter, 0);
     }
     state.fReporter->bumpTestCount();

tests/PathOpsSkpClipTest.cpp

diff --git a/tests/PathOpsSkpClipTest.cpp b/tests/PathOpsSkpClipTest.cpp
index 99a5030..3cc788f 100755
--- a/tests/PathOpsSkpClipTest.cpp
+++ b/tests/PathOpsSkpClipTest.cpp
@@ -1086,7 +1086,7 @@
     if (FLAGS_verbose) {
         header.appendf("\n");
     }
-    SkDebugf(header.c_str());
+    SkDebugf("%s", header.c_str());
     Iter iter;
     Test* test;
     while ((test = iter.next()) != NULL) {

tests/skia_test.cpp

diff --git a/tests/skia_test.cpp b/tests/skia_test.cpp
index 2aca99d..74029d4 100644
--- a/tests/skia_test.cpp
+++ b/tests/skia_test.cpp
@@ -164,7 +164,7 @@
         if (FLAGS_veryVerbose) {
             header.appendf("\n");
         }
-        SkDebugf(header.c_str());
+        SkDebugf("%s", header.c_str());
     }