commit 7b38e3cf75296c749c843fa89af14f70f4e4b2db
author fmalita <fmalita@chromium.org> Thu May 26 11:13:52 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu May 26 11:13:52 2016 -0700
tree 04907815dd6f68db55ee9df0958ab5549a801a1e
parent 0e5b249e549a540bd89d525369b950c9e4404235

Fix int32 overflow in LinearGradientContext::shade4_dx_clamp

The unconditional increment in shade4_dx_clamp can overflow int32

=> n == SK_MinS32
=> count ~= SK_MinS32
=> we skip the main shader loop 'cause count < 0

R=reed@google.com,mtklein@google.com
BUG=chromium:599458
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2010843002

Review-Url: https://codereview.chromium.org/2010843002

src/effects/gradients/SkLinearGradient.cpp

diff --git a/src/effects/gradients/SkLinearGradient.cpp b/src/effects/gradients/SkLinearGradient.cpp
index 1bdce39..209b833 100644
--- a/src/effects/gradients/SkLinearGradient.cpp
+++ b/src/effects/gradients/SkLinearGradient.cpp
@@ -610,7 +610,10 @@
 
     if (dx_is_pos) {
         if (fx < 0) {
-            int n = SkTMin(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[0].fColor);
             count -= n;
             dstC += n;
@@ -622,7 +625,10 @@
         }
     } else { // dx < 0
         if (fx > 1) {
-            int n = SkTMin(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[fRecs.count() - 1].fColor);
             count -= n;
             dstC += n;

tests/GradientTest.cpp

diff --git a/tests/GradientTest.cpp b/tests/GradientTest.cpp
index ac55d99..7add42d 100644
--- a/tests/GradientTest.cpp
+++ b/tests/GradientTest.cpp
@@ -234,6 +234,25 @@
     REPORTER_ASSERT(reporter, SkGetPackedR32(centerPMColor) == 0);
 }
 
+// http://crbug.com/599458
+static void test_clamping_overflow(skiatest::Reporter*) {
+    SkPaint p;
+    const SkColor colors[] = { SK_ColorRED, SK_ColorGREEN };
+    const SkPoint pts1[] = { SkPoint::Make(1001, 1000001), SkPoint::Make(1000.99f, 1000000) };
+
+    p.setShader(SkGradientShader::MakeLinear(pts1, colors, nullptr, 2, SkShader::kClamp_TileMode));
+
+    sk_sp<SkSurface> surface(SkSurface::MakeRasterN32Premul(50, 50));
+    surface->getCanvas()->scale(100, 100);
+    surface->getCanvas()->drawPaint(p);
+
+    const SkPoint pts2[] = { SkPoint::Make(10000.99f, 1000000), SkPoint::Make(10001, 1000001) };
+    p.setShader(SkGradientShader::MakeLinear(pts2, colors, nullptr, 2, SkShader::kClamp_TileMode));
+    surface->getCanvas()->drawPaint(p);
+
+    // Passes if we don't trigger asserts.
+}
+
 DEF_TEST(Gradient, reporter) {
     TestGradientShaders(reporter);
     TestConstantGradient(reporter);
@@ -241,4 +260,5 @@
     test_nearly_vertical(reporter);
     test_linear_fuzz(reporter);
     test_two_point_conical_zero_radius(reporter);
+    test_clamping_overflow(reporter);
 }