validate that contours begin with moveTo

Bug: skia:7507
Change-Id: Iba6e99443c56402ac1417a094f08d346c6e5a1a8
Reviewed-on: https://skia-review.googlesource.com/101128
Commit-Queue: Mike Reed <reed@google.com>
Reviewed-by: Mike Klein <mtklein@chromium.org>

1 files changed, 31 insertions, 0 deletions

diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 562838b530..c185abaeb7 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -199,6 +199,34 @@ void SkPathRef::CreateTransformedCopy(sk_sp<SkPathRef>* dst,
     SkDEBUGCODE((*dst)->validate();)
 }
 
+static bool validate_verb_sequence(const uint8_t verbs[], int vCount) {
+    // verbs are stored backwards, but we need to visit them in logical order to determine if
+    // they form a valid sequence.
+
+    bool needsMoveTo = true;
+    bool invalidSequence = false;
+
+    for (int i = vCount - 1; i >= 0; --i) {
+        switch (verbs[i]) {
+            case SkPath::kMove_Verb:
+                needsMoveTo = false;
+                break;
+            case SkPath::kLine_Verb:
+            case SkPath::kQuad_Verb:
+            case SkPath::kConic_Verb:
+            case SkPath::kCubic_Verb:
+                invalidSequence |= needsMoveTo;
+                break;
+            case SkPath::kClose_Verb:
+                needsMoveTo = true;
+                break;
+            default:
+                return false;   // unknown verb
+        }
+    }
+    return !invalidSequence;
+}
+
 // Given the verb array, deduce the required number of pts and conics,
 // or if an invalid verb is encountered, return false.
 static bool deduce_pts_conics(const uint8_t verbs[], int vCount, int* ptCountPtr,
@@ -295,6 +323,9 @@ SkPathRef* SkPathRef::CreateFromBuffer(SkRBuffer* buffer) {
     // Check that the verbs are valid, and imply the correct number of pts and conics
     {
         int pCount, cCount;
+        if (!validate_verb_sequence(ref->verbsMemBegin(), ref->countVerbs())) {
+            return nullptr;
+        }
         if (!deduce_pts_conics(ref->verbsMemBegin(), ref->countVerbs(), &pCount, &cCount) ||
             pCount != ref->countPoints() || cCount != ref->fConicWeights.count()) {
             return nullptr;