commit 7b33bf1d2a8664235a9eb372024641d2da1a0dad
author caryclark <caryclark@google.com> Thu Jul 21 08:53:32 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu Jul 21 08:53:32 2016 -0700
tree 61b2a11b4105afdabf4f8d949914cfd32ae1b652
parent 5d1676c751040f4d9a6259720c15250f0c979874

fix builder fuzz

Fix ASAN_heap-use-after-free crash

R=kjlubick
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2168963002

Review-Url: https://codereview.chromium.org/2168963002

src/pathops/SkOpBuilder.cpp

diff --git a/src/pathops/SkOpBuilder.cpp b/src/pathops/SkOpBuilder.cpp
index 6652c10..ede1ed0 100644
--- a/src/pathops/SkOpBuilder.cpp
+++ b/src/pathops/SkOpBuilder.cpp
@@ -47,7 +47,12 @@
     SkOpGlobalState globalState(&contourHead, &allocator  SkDEBUGPARAMS(false)
             SkDEBUGPARAMS(nullptr));
     SkOpEdgeBuilder builder(*path, &contourHead, &globalState);
-    builder.finish();
+    if (builder.unparseable() || !builder.finish()) {
+        return false;
+    }
+    if (!contourHead.count()) {
+        return true;
+    }
     SkASSERT(contourHead.next());
     contourHead.resetReverse();
     bool writePath = false;

tests/PathOpsBuilderTest.cpp

diff --git a/tests/PathOpsBuilderTest.cpp b/tests/PathOpsBuilderTest.cpp
index 8547d85..ffeff5f 100644
--- a/tests/PathOpsBuilderTest.cpp
+++ b/tests/PathOpsBuilderTest.cpp
@@ -344,3 +344,20 @@
     builder.add(path1, SkPathOp::kUnion_SkPathOp);
     builder.resolve(&path0);
 }
+
+DEF_TEST(SkOpBuilderKFuzz1, reporter) {
+    SkPath path;
+path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
+path.lineTo(SkBits2Float(0x39008001), SkBits2Float(0xd31fbc1d));  // 0.000122547f, -6.86056e+11f
+path.conicTo(SkBits2Float(0x246a205a), SkBits2Float(0x0080d3fb), SkBits2Float(0xce000001), SkBits2Float(0x04d31fbc), SkBits2Float(0x57a82c00));  // 5.07681e-17f, 1.1831e-38f, -5.36871e+08f, 4.9635e-36f, 3.69814e+14f
+    SkPath path0(path);
+    path.reset();
+path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
+path.cubicTo(SkBits2Float(0x80d3f924), SkBits2Float(0xcecece4f), SkBits2Float(0xcececece), SkBits2Float(0xcececece), SkBits2Float(0x9a9a9ace), SkBits2Float(0x9a9a9a9a));  // -1.94667e-38f, -1.73481e+09f, -1.73483e+09f, -1.73483e+09f, -6.3943e-23f, -6.39427e-23f
+path.moveTo(SkBits2Float(0x9a9a019a), SkBits2Float(0xa59a9a9a));  // -6.36955e-23f, -2.68195e-16f
+    SkPath path1(path);
+SkOpBuilder builder;
+    builder.add(path0, SkPathOp::kUnion_SkPathOp);
+    builder.add(path1, SkPathOp::kUnion_SkPathOp);
+    builder.resolve(&path);
+}