fix mask address calculation
Switching the math from using fMaskPtr.stride to using mask.fRowBytes
fixes the integer overflow here. However, if done naively it'd still do
the math wrong, as mask.fRowBytes is stored as a uint32_t, and the
32-bit overflow still happens, silently. So we explicitly promote to
size_t too.
As a follow up we should consider turning on 'integer' sanitizer, which
treats unsigned integer overflow as an error. Even though it's
technically defined, it's likely not intended.
Bug: skia:7563
Change-Id: Ia579d4f5615ed28180e6aaf3d4c3b54f516e655c
Reviewed-on: https://skia-review.googlesource.com/110260
Commit-Queue: Mike Klein <mtklein@chromium.org>
Reviewed-by: Kevin Lubick <kjlubick@google.com>
1 file changed