commit 6a300ac5b7edb4737695a7a573f9fa786c324c72
author Jim Van Verth <jvanverth@google.com> Tue Oct 23 13:19:21 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue Oct 23 18:23:06 2018 +0000
tree 4ff9648420a79b55085f16c0a6eb8a8101c5f1f3
parent fd731e46846c0af350f3cefbfd8c8fecf7ee29ae

Check for valid initialization of ReflexHash

Bug: oss-fuzz:11027
Change-Id: I5cdce5d01ab339d19fcb57fc118d4e92da9a4842
Reviewed-on: https://skia-review.googlesource.com/c/164608
Reviewed-by: Kevin Lubick <kjlubick@google.com>
Commit-Queue: Jim Van Verth <jvanverth@google.com>

src/utils/SkPolyUtils.cpp

diff --git a/src/utils/SkPolyUtils.cpp b/src/utils/SkPolyUtils.cpp
index ee532fa..aabd6d4 100644
--- a/src/utils/SkPolyUtils.cpp
+++ b/src/utils/SkPolyUtils.cpp
@@ -1439,18 +1439,30 @@
 // Data structure to track reflex vertices and check whether any are inside a given triangle
 class ReflexHash {
 public:
-    ReflexHash(const SkRect& bounds, int vertexCount)
-            : fBounds(bounds)
-            , fNumVerts(0) {
+    bool init(const SkRect& bounds, int vertexCount) {
+        fBounds = bounds;
+        fNumVerts = 0;
+
         // We want vertexCount grid cells, roughly distributed to match the bounds ratio
-        SkScalar hCount = SkScalarSqrt(vertexCount*bounds.width()/bounds.height());
+        SkScalar hCount = SkScalarSqrt(sk_ieee_float_divide(vertexCount*bounds.width(),
+                                                            bounds.height()));
+        if (!SkScalarIsFinite(hCount)) {
+            return false;
+        }
         fHCount = SkTMax(SkTMin(SkScalarRoundToInt(hCount), vertexCount), 1);
         fVCount = vertexCount/fHCount;
-        fGridConversion.set((fHCount - 0.001f)/bounds.width(), (fVCount - 0.001f)/bounds.height());
+        fGridConversion.set(sk_ieee_float_divide(fHCount - 0.001f, bounds.width()),
+                            sk_ieee_float_divide(fVCount - 0.001f, bounds.height()));
+        if (!fGridConversion.isFinite()) {
+            return false;
+        }
+
         fGrid.setCount(fHCount*fVCount);
         for (int i = 0; i < fGrid.count(); ++i) {
             fGrid[i].reset();
         }
+
+        return true;
     }
 
     void add(TriangulationVertex* v) {
@@ -1501,6 +1513,7 @@
     int hash(TriangulationVertex* vert) const {
         int h = (vert->fPosition.fX - fBounds.fLeft)*fGridConversion.fX;
         int v = (vert->fPosition.fY - fBounds.fTop)*fGridConversion.fY;
+        SkASSERT(v*fHCount + h >= 0);
         return v*fHCount + h;
     }
 
@@ -1578,7 +1591,10 @@
     // Classify initial vertices into a list of convex vertices and a hash of reflex vertices
     // TODO: possibly sort the convexList in some way to get better triangles
     SkTInternalLList<TriangulationVertex> convexList;
-    ReflexHash reflexHash(bounds, polygonSize);
+    ReflexHash reflexHash;
+    if (!reflexHash.init(bounds, polygonSize)) {
+        return false;
+    }
     prevIndex = polygonSize - 1;
     for (int currIndex = 0; currIndex < polygonSize; prevIndex = currIndex, ++currIndex) {
         TriangulationVertex::VertexType currType = triangulationVertices[currIndex].fVertexType;