commit 405b9d23f80c764553fb512f57ce45eef3129c8d
author Mike Reed <reed@google.com> Tue Jan 09 15:11:08 2018 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue Jan 09 21:41:58 2018 +0000
tree 33128c14c4b43add7e95b5d54354c22e2dd33ebe
parent edef8ec4b24f9d2ce76e4c53304e25853888bee4

detect bad conic weights

Bug: skia:7478
Change-Id: I5fb254e10f3f38184fe41eb01e543f04b1a03081
Reviewed-on: https://skia-review.googlesource.com/92641
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Mike Reed <reed@google.com>

src/core/SkPath.cpp

diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index ff0152b..fe557d0 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -2214,7 +2214,7 @@
 #include "SkStream.h"
 
 static void append_params(SkString* str, const char label[], const SkPoint pts[],
-                          int count, SkScalarAsStringType strType, SkScalar conicWeight = -1) {
+                          int count, SkScalarAsStringType strType, SkScalar conicWeight = -12345) {
     str->append(label);
     str->append("(");
 
@@ -2227,7 +2227,7 @@
             str->append(", ");
         }
     }
-    if (conicWeight >= 0) {
+    if (conicWeight != -12345) {
         str->append(", ");
         SkAppendScalar(str, conicWeight, strType);
     }

src/core/SkPathRef.cpp

diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 0ea9305..055b63d 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -13,6 +13,16 @@
 #include "SkPathPriv.h"
 #include "SkSafeMath.h"
 
+// Conic weights must be 0 < weight <= finite
+static bool validate_conic_weights(const SkScalar weights[], int count) {
+    for (int i = 0; i < count; ++i) {
+        if (weights[i] <= 0 || !SkScalarIsFinite(weights[i])) {
+            return false;
+        }
+    }
+    return true;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 SkPathRef::Editor::Editor(sk_sp<SkPathRef>* pathRef,
                           int incReserveVerbs,
@@ -289,6 +299,9 @@
             pCount != ref->countPoints() || cCount != ref->fConicWeights.count()) {
             return nullptr;
         }
+        if (!validate_conic_weights(ref->fConicWeights.begin(), ref->fConicWeights.count())) {
+            return nullptr;
+        }
         // Check that the bounds match the serialized bounds.
         SkRect bounds;
         if (ComputePtBounds(&bounds, *ref) != SkToBool(ref->fIsFinite) || bounds != ref->fBounds) {