commit 9a061a5c2b22055b46464ca243d94feee105e5c9
author Cary Clark <caryclark@skia.org> Mon Nov 26 07:55:25 2018 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Mon Nov 26 13:24:40 2018 +0000
tree 5d2a25c3bd452c7f9523a390acd0cfcf30bfe0e0
parent bc97432f4f93dc6e588782b990823551bb3f4927

fix pathops fuzz

add escape hatch to abort infinite loop
when fed fuzzed data

R=kjlubick@google.com

Docs-Preview: https://skia.org/?cl=172745
Bug: 907844
Change-Id: I015fa1f6f8b697ad438e3d17c4254b65511d699e
Reviewed-on: https://skia-review.googlesource.com/c/172745
Commit-Queue: Cary Clark <caryclark@skia.org>
Commit-Queue: Kevin Lubick <kjlubick@google.com>
Auto-Submit: Cary Clark <caryclark@skia.org>
Reviewed-by: Kevin Lubick <kjlubick@google.com>

src/pathops/SkOpSegment.cpp

diff --git a/src/pathops/SkOpSegment.cpp b/src/pathops/SkOpSegment.cpp
index 7953c25..ff21828 100644
--- a/src/pathops/SkOpSegment.cpp
+++ b/src/pathops/SkOpSegment.cpp
@@ -1273,7 +1273,11 @@
         }
         SkOpPtT* startPtT = test->ptT();
         SkOpPtT* testPtT = startPtT;
+        int safetyHatch = 1000000;
         do {  // iterate through all spans associated with start
+            if (!--safetyHatch) {
+                return false;
+            }
             SkOpSpanBase* oppSpan = testPtT->span();
             if (oppSpan->spanAddsCount() == addCount) {
                 continue;