diff options
| author |  commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-09-13 12:40:02 +0000 |
|---|---|---|
| committer | commit-bot@chromium.org <commit-bot@chromium.org@2bbb7eff-a529-9590-31e7-b0007b416f81> | 2013-09-13 12:40:02 +0000 |
| commit | 4b681bc95b14e081f1cc5b68cb755d57fc8eb977 (patch) | |
| tree | 6ee87e778e6cee5d76ed286b3b92852f3da17b4f /include/effects | |
| parent | ab13167410206c5371508101949213d46e8dded9 (diff) | |
Fixed issues found by fuzzer
Last week, the fuzzer found a few numerical issue with filters and I had written some fixes for them. Here are the fixes with some unit tests.
For senorblanco : So I figured out what was asserting when we'd get a 0 width "result" in SkBicubicImageFilter::onFilterImage(). Basically, if the "result" SkBitmap object calls SkBitmap::setConfig() with "width" and/or "height" set to 0, then the SkBitmap object will call SkBitmap::reset(), making the SkBitmap object's config invalid. At this point, calling SkBitmap::getAddr32() will assert, even without attempting to dereference the data pointer, because the SkBitmap's config is invalid. If height is valid, but width is 0, then this call to SkBitmap::getAddr32() happens directly in SkBicubicImageFilter::onFilterImage() a few lines lower and asserts right away.
BUG=
R=senorblanco@google.com, senorblanco@chromium.org, bsalomon@google.com
Author: sugoi@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23533042
git-svn-id: http://skia.googlecode.com/svn/trunk@11249 2bbb7eff-a529-9590-31e7-b0007b416f81
Diffstat (limited to 'include/effects')
| -rw-r--r-- | include/effects/SkLightingImageFilter.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/effects/SkLightingImageFilter.h b/include/effects/SkLightingImageFilter.h index 07f713b0af..9c90cd949b 100644 --- a/include/effects/SkLightingImageFilter.h +++ b/include/effects/SkLightingImageFilter.h @@ -26,7 +26,8 @@ public: return fX > fY ? (fX > fZ ? fX : fZ) : (fY > fZ ? fY : fZ); } void normalize() { - SkScalar scale = SkScalarInvert(SkScalarSqrt(dot(*this))); + // Small epsilon is added to prevent division by 0. + SkScalar scale = SkScalarInvert(SkScalarSqrt(dot(*this)) + SK_ScalarNearlyZero); fX = SkScalarMul(fX, scale); fY = SkScalarMul(fY, scale); fZ = SkScalarMul(fZ, scale); |