use safe increment for edge walker

Bug: oss-fuzz:6126
Change-Id: I8f6865cbbbfbe37acf940cc2d4ae93204ba7168d
Reviewed-on: https://skia-review.googlesource.com/107783
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/src/core/SkScan_Path.cpp b/src/core/SkScan_Path.cpp
index 6234afe873..9c20527fbc 100644
--- a/src/core/SkScan_Path.cpp
+++ b/src/core/SkScan_Path.cpp
@@ -15,6 +15,7 @@
 #include "SkRasterClip.h"
 #include "SkRectPriv.h"
 #include "SkRegion.h"
+#include "SkSafe32.h"
 #include "SkTemplates.h"
 #include "SkTSort.h"
 
@@ -259,8 +260,12 @@ static void walk_convex_edges(SkEdge* prevHead, SkPath::FillType,
                 if (L < R) {
                     blitter->blitH(L, local_top, R - L);
                 }
-                left += dLeft;
-                rite += dRite;
+                // Either/both of these might overflow, since we perform this step even if
+                // (later) we determine that we are done with the edge, and so the computed
+                // left or rite edge will not be used (see update_edge). Use this helper to
+                // silence UBSAN when we perform the add.
+                left = Sk32_can_overflow_add(left, dLeft);
+                rite = Sk32_can_overflow_add(rite, dRite);
                 local_top += 1;
             } while (--count >= 0);
         }