commit 79aa2f12ab4e2f51e98db8f18175e10d8050821f
author Cary Clark <caryclark@skia.org> Thu May 31 16:22:02 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu May 31 21:10:54 2018 +0000
tree 951ba629eaf05e5f6601dd551fe2f694cec7a5c4
parent b4a8a629406fd84c04ecbb1bd2301cfbff91121d

don't walk off end of pointer

Avoids pointer-overflow in ASAN/UBSAN.

R=mtklein@google.com

Bug:836282
Change-Id: I2125fa7927c30ae601431af8daec0f900c84799c
Reviewed-on: https://skia-review.googlesource.com/131261
Auto-Submit: Cary Clark <caryclark@skia.org>
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Mike Klein <mtklein@google.com>

src/pathops/SkOpEdgeBuilder.cpp

diff --git a/src/pathops/SkOpEdgeBuilder.cpp b/src/pathops/SkOpEdgeBuilder.cpp
index 16cbfc4..363933e 100644
--- a/src/pathops/SkOpEdgeBuilder.cpp
+++ b/src/pathops/SkOpEdgeBuilder.cpp
@@ -175,10 +175,11 @@
 bool SkOpEdgeBuilder::walk() {
     uint8_t* verbPtr = fPathVerbs.begin();
     uint8_t* endOfFirstHalf = &verbPtr[fSecondHalf];
-    SkPoint* pointsPtr = fPathPts.begin() - 1;
+    SkPoint* pointsPtr = fPathPts.begin();
     SkScalar* weightPtr = fWeights.begin();
     SkPath::Verb verb;
     SkOpContour* contour = fContourBuilder.contour();
+    int moveToPtrBump = 0;
     while ((verb = (SkPath::Verb) *verbPtr) != SkPath::kDone_Verb) {
         if (verbPtr == endOfFirstHalf) {
             fOperand = true;
@@ -198,7 +199,8 @@
                 }
                 contour->init(fGlobalState, fOperand,
                     fXorMask[fOperand] == kEvenOdd_PathOpsMask);
-                pointsPtr += 1;
+                pointsPtr += moveToPtrBump;
+                moveToPtrBump = 1;
                 continue;
             case SkPath::kLine_Verb:
                 fContourBuilder.addLine(pointsPtr);