commit c55bc9a8dd6e48a8b16f191d078022298737941a
author Matt Sarett <msarett@google.com> Fri Jan 13 13:58:57 2017 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Fri Jan 13 19:49:19 2017 +0000
tree 57972c2dadfa8de9980a08a0815a95b43c3a4696
parent 3b830a9ea3bce9eba663ab95486cf153831cd29c

Fix out of bounds read in RP::load_tables_u16_be()

BUG=skia:

CQ_INCLUDE_TRYBOTS=skia.primary:Test-Ubuntu-GCC-GCE-CPU-AVX2-x86_64-Release-SKNX_NO_SIMD

Change-Id: I4f6dd002b03812d63bf62342c346ea21f6865466
Reviewed-on: https://skia-review.googlesource.com/7027
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Matt Sarett <msarett@google.com>

tests/ColorSpaceXformTest.cpp

diff --git a/tests/ColorSpaceXformTest.cpp b/tests/ColorSpaceXformTest.cpp
index 03a9263..a72cbbf 100644
--- a/tests/ColorSpaceXformTest.cpp
+++ b/tests/ColorSpaceXformTest.cpp
@@ -322,3 +322,18 @@
     }
 }
 
+DEF_TEST(SkColorSpaceXform_LoadTail, r) {
+    uint64_t* srcPixel = new uint64_t[1];
+    srcPixel[0] = 0;
+    uint32_t dstPixel;
+    sk_sp<SkColorSpace> adobe = SkColorSpace::MakeNamed(SkColorSpace::kAdobeRGB_Named);
+    sk_sp<SkColorSpace> srgb = SkColorSpace::MakeNamed(SkColorSpace::kSRGB_Named);
+    std::unique_ptr<SkColorSpaceXform> xform = SkColorSpaceXform::New(adobe.get(), srgb.get());
+
+    // ASAN will catch us if we read past the tail.
+    bool success = xform->apply(SkColorSpaceXform::kRGBA_8888_ColorFormat, &dstPixel,
+                                SkColorSpaceXform::kRGBA_U16_BE_ColorFormat, srcPixel, 1,
+                                kUnpremul_SkAlphaType);
+    REPORTER_ASSERT(r, success);
+}
+