diff options
| author |  Mike Klein <mtklein@chromium.org> | 2017-10-10 11:30:10 -0400 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2017-10-10 16:31:25 +0000 |
| commit | 24f0a354ac618c17a71e4dac80dd0ad370ed14eb (patch) | |
| tree | 1adf5d38af78117c408845cf903a56ede144ceae /src/core/SkColorSpaceXform.cpp | |
| parent | 1a3457d3fc1a4a11a2436828878aa1f27de78b2f (diff) | |
SkColorSpaceXform: clamp before table lookups
The fuzzer has built a single test case that causes out-of-bounds
reads on both the src and dst tables. I'm glad we have it.
Next follow ups may include:
- have byte_tables_rgb do its own clamping
- replace table_{r,g,b} here with a single stage analogous
to byte_tables_rgb that looks up the three float tables
safely
- maybe replace byte_tables_rgb with that. I'm not really
sure why src->XYZ tables are floats but XYZ->dst are bytes.
I'm going to try some of these out before attempting to reland
in Chrome. As usual, rebaselining Blink makes things a pain.
Bug: chromium:772684, skia:7114
Change-Id: Id8759e766330e1c7689c0847bf2cd35d422ebbcd
Reviewed-on: https://skia-review.googlesource.com/57760
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
Diffstat (limited to 'src/core/SkColorSpaceXform.cpp')
| -rw-r--r-- | src/core/SkColorSpaceXform.cpp | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/core/SkColorSpaceXform.cpp b/src/core/SkColorSpaceXform.cpp index 887b0a0361..e2aa773d22 100644 --- a/src/core/SkColorSpaceXform.cpp +++ b/src/core/SkColorSpaceXform.cpp @@ -611,7 +611,9 @@ bool SkColorSpaceXform_XYZ::onApply(ColorFormat dstColorFormat, void* dst, switch (fSrcGamma) { case kLinear_SrcGamma: break; case kSRGB_SrcGamma: pipeline.append_from_srgb(kUnpremul_SkAlphaType); break; - case kTable_SrcGamma: pipeline.append(SkRasterPipeline::table_r, &table_r); + case kTable_SrcGamma: pipeline.append(SkRasterPipeline::clamp_0); + pipeline.append(SkRasterPipeline::clamp_1); + pipeline.append(SkRasterPipeline::table_r, &table_r); pipeline.append(SkRasterPipeline::table_g, &table_g); pipeline.append(SkRasterPipeline::table_b, &table_b); break; } @@ -642,7 +644,9 @@ bool SkColorSpaceXform_XYZ::onApply(ColorFormat dstColorFormat, void* dst, case kLinear_DstGamma: break; case kSRGB_DstGamma: pipeline.append(SkRasterPipeline::to_srgb); break; case k2Dot2_DstGamma: pipeline.append(SkRasterPipeline::gamma, &to_2dot2); break; - case kTable_DstGamma: pipeline.append(SkRasterPipeline::byte_tables_rgb, &tables); break; + case kTable_DstGamma: pipeline.append(SkRasterPipeline::clamp_0); + pipeline.append(SkRasterPipeline::clamp_1); + pipeline.append(SkRasterPipeline::byte_tables_rgb, &tables); break; } if (kPremul_SkAlphaType == alphaType && SkTransferFunctionBehavior::kIgnore == fPremulBehavior) { |