detect bad conic weights

Bug: skia:7478
Change-Id: I5fb254e10f3f38184fe41eb01e543f04b1a03081
Reviewed-on: https://skia-review.googlesource.com/92641
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 0ea9305003..055b63d142 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -13,6 +13,16 @@
 #include "SkPathPriv.h"
 #include "SkSafeMath.h"
 
+// Conic weights must be 0 < weight <= finite
+static bool validate_conic_weights(const SkScalar weights[], int count) {
+    for (int i = 0; i < count; ++i) {
+        if (weights[i] <= 0 || !SkScalarIsFinite(weights[i])) {
+            return false;
+        }
+    }
+    return true;
+}
+
 //////////////////////////////////////////////////////////////////////////////
 SkPathRef::Editor::Editor(sk_sp<SkPathRef>* pathRef,
                           int incReserveVerbs,
@@ -289,6 +299,9 @@ SkPathRef* SkPathRef::CreateFromBuffer(SkRBuffer* buffer) {
             pCount != ref->countPoints() || cCount != ref->fConicWeights.count()) {
             return nullptr;
         }
+        if (!validate_conic_weights(ref->fConicWeights.begin(), ref->fConicWeights.count())) {
+            return nullptr;
+        }
         // Check that the bounds match the serialized bounds.
         SkRect bounds;
         if (ComputePtBounds(&bounds, *ref) != SkToBool(ref->fIsFinite) || bounds != ref->fBounds) {