detect bad conic weights

Bug: skia:7478
Change-Id: I5fb254e10f3f38184fe41eb01e543f04b1a03081
Reviewed-on: https://skia-review.googlesource.com/92641
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Mike Reed <reed@google.com>

2 files changed, 15 insertions, 2 deletions

diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index ff0152bb4a..fe557d0fe9 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -2214,7 +2214,7 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) {
 #include "SkStream.h"
 
 static void append_params(SkString* str, const char label[], const SkPoint pts[],
-                          int count, SkScalarAsStringType strType, SkScalar conicWeight = -1) {
+                          int count, SkScalarAsStringType strType, SkScalar conicWeight = -12345) {
     str->append(label);
     str->append("(");
 
@@ -2227,7 +2227,7 @@ static void append_params(SkString* str, const char label[], const SkPoint pts[]
             str->append(", ");
         }
     }
-    if (conicWeight >= 0) {
+    if (conicWeight != -12345) {
         str->append(", ");
         SkAppendScalar(str, conicWeight, strType);
     }
diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 0ea9305003..055b63d142 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -13,6 +13,16 @@
 #include "SkPathPriv.h"
 #include "SkSafeMath.h"
 
+// Conic weights must be 0 < weight <= finite
+static bool validate_conic_weights(const SkScalar weights[], int count) {
+    for (int i = 0; i < count; ++i) {
+        if (weights[i] <= 0 || !SkScalarIsFinite(weights[i])) {
+            return false;
+        }
+    }
+    return true;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 SkPathRef::Editor::Editor(sk_sp<SkPathRef>* pathRef,
                           int incReserveVerbs,
@@ -289,6 +299,9 @@ SkPathRef* SkPathRef::CreateFromBuffer(SkRBuffer* buffer) {
             pCount != ref->countPoints() || cCount != ref->fConicWeights.count()) {
             return nullptr;
         }
+        if (!validate_conic_weights(ref->fConicWeights.begin(), ref->fConicWeights.count())) {
+            return nullptr;
+        }
         // Check that the bounds match the serialized bounds.
         SkRect bounds;
         if (ComputePtBounds(&bounds, *ref) != SkToBool(ref->fIsFinite) || bounds != ref->fBounds) {