commit 66869e91a1e2cd21dfc4300fcdf3851a39ca0a1a
author Ethan Nicholas <ethannicholas@google.com> Thu Apr 30 09:27:54 2020 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu Apr 30 14:42:50 2020 +0000
tree 36173154f8acc3ef6d76e47fc2c4da58ea89b2fe
parent 298bda131ceedec87f667fdc3cb7db664a8ce862

Fixed UB in SkSL constant arithmetic

Change-Id: Ic6da9f043a6657added5f9a3d1fed919043db9e0
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/286436
Auto-Submit: Ethan Nicholas <ethannicholas@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>

src/sksl/SkSLIRGenerator.cpp

diff --git a/src/sksl/SkSLIRGenerator.cpp b/src/sksl/SkSLIRGenerator.cpp
index f8ff5d8..8061f21 100644
--- a/src/sksl/SkSLIRGenerator.cpp
+++ b/src/sksl/SkSLIRGenerator.cpp
@@ -1563,21 +1563,29 @@
         int64_t leftVal  = ((IntLiteral&) left).fValue;
         int64_t rightVal = ((IntLiteral&) right).fValue;
         switch (op) {
-            case Token::Kind::TK_PLUS:       return RESULT(Int, +);
-            case Token::Kind::TK_MINUS:      return RESULT(Int, -);
-            case Token::Kind::TK_STAR:       return RESULT(Int, *);
+            case Token::Kind::TK_PLUS:       return URESULT(Int, +);
+            case Token::Kind::TK_MINUS:      return URESULT(Int, -);
+            case Token::Kind::TK_STAR:       return URESULT(Int, *);
             case Token::Kind::TK_SLASH:
-                if (rightVal) {
-                    return RESULT(Int, /);
+                if (leftVal == std::numeric_limits<int64_t>::min() && rightVal == -1) {
+                    fErrors.error(right.fOffset, "arithmetic overflow");
+                    return nullptr;
                 }
-                fErrors.error(right.fOffset, "division by zero");
-                return nullptr;
+                if (!rightVal) {
+                    fErrors.error(right.fOffset, "division by zero");
+                    return nullptr;
+                }
+                return RESULT(Int, /);
             case Token::Kind::TK_PERCENT:
-                if (rightVal) {
-                    return RESULT(Int, %);
+                if (leftVal == std::numeric_limits<int64_t>::min() && rightVal == -1) {
+                    fErrors.error(right.fOffset, "arithmetic overflow");
+                    return nullptr;
                 }
-                fErrors.error(right.fOffset, "division by zero");
-                return nullptr;
+                if (!rightVal) {
+                    fErrors.error(right.fOffset, "division by zero");
+                    return nullptr;
+                }
+                return RESULT(Int, %);
             case Token::Kind::TK_BITWISEAND: return RESULT(Int,  &);
             case Token::Kind::TK_BITWISEOR:  return RESULT(Int,  |);
             case Token::Kind::TK_BITWISEXOR: return RESULT(Int,  ^);