check for non-finite values output by clipper

Bug: oss-fuzz:7452
Change-Id: Id1b9bd1ad9245f32d69b7ce97544955fcde5670f
Reviewed-on: https://skia-review.googlesource.com/121102
Reviewed-by: Mike Klein <mtklein@google.com>
Reviewed-by: Cary Clark <caryclark@google.com>
Reviewed-by: Yuqian Li <liyuqian@google.com>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 10 insertions, 4 deletions

diff --git a/src/core/SkEdgeBuilder.cpp b/src/core/SkEdgeBuilder.cpp
index d0a2253740..b7d80b047c 100644
--- a/src/core/SkEdgeBuilder.cpp
+++ b/src/core/SkEdgeBuilder.cpp
@@ -5,12 +5,13 @@
  * found in the LICENSE file.
  */
 #include "SkEdgeBuilder.h"
-#include "SkPath.h"
 #include "SkEdge.h"
 #include "SkAnalyticEdge.h"
 #include "SkEdgeClipper.h"
 #include "SkLineClipper.h"
 #include "SkGeometry.h"
+#include "SkPath.h"
+#include "SkPathPriv.h"
 
 ///////////////////////////////////////////////////////////////////////////////
 
@@ -215,6 +216,11 @@ void SkEdgeBuilder::addClipper(SkEdgeClipper* clipper) {
     SkPath::Verb verb;
 
     while ((verb = clipper->next(pts)) != SkPath::kDone_Verb) {
+        const int count = SkPathPriv::PtsInIter(verb);
+        if (!SkScalarsAreFinite(&pts[0].fX, count*2)) {
+            fIsFinite = false;
+            return;
+        }
         switch (verb) {
             case SkPath::kLine_Verb:
                 this->addLine(pts);
@@ -332,7 +338,7 @@ int SkEdgeBuilder::buildPoly(const SkPath& path, const SkIRect* iclip, int shift
     }
     SkASSERT((size_t)(edge - edgeStart) <= maxEdgeCount * edgeSize);
     SkASSERT((size_t)(edgePtr - (char**)fEdgeList) <= maxEdgeCount);
-    return SkToInt(edgePtr - (char**)fEdgeList);
+    return fIsFinite ? SkToInt(edgePtr - (char**)fEdgeList) : 0;
 }
 
 static void handle_quad(SkEdgeBuilder* builder, const SkPoint pts[3]) {
@@ -445,7 +451,7 @@ int SkEdgeBuilder::build(const SkPath& path, const SkIRect* iclip, int shiftUp,
         }
     }
     fEdgeList = fList.begin();
-    return fList.count();
+    return fIsFinite ? fList.count() : 0;
 }
 
 int SkEdgeBuilder::build_edges(const SkPath& path, const SkIRect* shiftedClip,
@@ -462,5 +468,5 @@ int SkEdgeBuilder::build_edges(const SkPath& path, const SkIRect* shiftedClip,
     // For example, a single cubic edge with a valley shape \_/ is fine for DAA.
     SkASSERT(edgeType == kBezier || canCullToTheRight || count != 1);
 
-    return count;
+    return fIsFinite ? count : 0;
 }