commit 9afad684538aca7017d6a8a59357df0570a1ce74
author Mike Reed <reed@google.com> Thu May 03 11:26:36 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu May 03 16:11:11 2018 +0000
tree b5f4c40f45799925a4d9473b91841ded9e59d259
parent 8ba34f82dd3c881c37b9e59d3f650e2401f98d0e

saturate your adds

Bug: oss-fuzz:6149
Change-Id: Ia9a7b1e4a0d3dbbdcfb4469a8c50ffa512574fd1
Reviewed-on: https://skia-review.googlesource.com/125461
Commit-Queue: Mike Reed <reed@google.com>
Reviewed-by: Robert Phillips <robertphillips@google.com>

src/core/SkImageFilter.cpp

diff --git a/src/core/SkImageFilter.cpp b/src/core/SkImageFilter.cpp
index c732901..7ce2cf3 100644
--- a/src/core/SkImageFilter.cpp
+++ b/src/core/SkImageFilter.cpp
@@ -14,6 +14,7 @@
 #include "SkMatrixImageFilter.h"
 #include "SkReadBuffer.h"
 #include "SkRect.h"
+#include "SkSafe32.h"
 #include "SkSpecialImage.h"
 #include "SkSpecialSurface.h"
 #include "SkValidationUtils.h"
@@ -72,14 +73,14 @@
                 cropped->fLeft = devICropR.fLeft;
             }
         } else {
-            devICropR.fRight = cropped->fLeft + devICropR.width();
+            devICropR.fRight = Sk32_sat_add(cropped->fLeft, devICropR.width());
         }
         if (fFlags & kHasTop_CropEdge) {
             if (embiggen || devICropR.fTop > cropped->fTop) {
                 cropped->fTop = devICropR.fTop;
             }
         } else {
-            devICropR.fBottom = cropped->fTop + devICropR.height();
+            devICropR.fBottom = Sk32_sat_add(cropped->fTop, devICropR.height());
         }
         if (fFlags & kHasWidth_CropEdge) {
             if (embiggen || devICropR.fRight < cropped->fRight) {