commit 59ed482af72beec6812b28d833d8bdf80ba32df7
author Cary Clark <caryclark@google.com> Thu Dec 08 16:17:56 2016 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu Dec 08 22:22:12 2016 +0000
tree 7f993451a2ed6eada726393f3067bae1f2dcfe82
parent 8e7432b7f98dd592e529a0c8bb038d73ebfb0478

fix fuzzers

Two crashes and a hang. Abort and return false
in these cases.

TBR=kjlubick@google.com
BUG=skia:5983

Change-Id: I41ac3e56d47ee423b634b2f4886085b9caada76b
Reviewed-on: https://skia-review.googlesource.com/5716
Reviewed-by: Cary Clark <caryclark@google.com>
Reviewed-by: Kevin Lubick <kjlubick@google.com>
Commit-Queue: Cary Clark <caryclark@google.com>

src/pathops/SkPathOpsTSect.h

diff --git a/src/pathops/SkPathOpsTSect.h b/src/pathops/SkPathOpsTSect.h
index f3402da..5d74c9a 100644
--- a/src/pathops/SkPathOpsTSect.h
+++ b/src/pathops/SkPathOpsTSect.h
@@ -1162,6 +1162,7 @@
 bool SkTSect<TCurve, OppCurve>::deleteEmptySpans() {
     SkTSpan<TCurve, OppCurve>* test;
     SkTSpan<TCurve, OppCurve>* next = fHead;
+    int safetyHatch = 1000;
     while ((test = next)) {
         next = test->fNext;
         if (!test->fBounded) {
@@ -1169,6 +1170,9 @@
                 return false;
             }
         }
+        if (--safetyHatch < 0) {
+            return false;
+        }
     }
     return true;
 }
@@ -2234,7 +2238,13 @@
         }
         if (sect1->fActiveCount >= COINCIDENT_SPAN_COUNT
                 && sect2->fActiveCount >= COINCIDENT_SPAN_COUNT) {
+            if (!sect1->fHead) {
+                return;
+            }
             sect1->computePerpendiculars(sect2, sect1->fHead, sect1->tail());
+            if (!sect2->fHead) {
+                return;
+            }
             sect2->computePerpendiculars(sect1, sect2->fHead, sect2->tail());
             sect1->removeByPerpendicular(sect2);
             sect1->validate();