diff options
| author |  Khushal <khushalsagar@chromium.org> | 2018-06-12 11:26:17 -0700 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2018-06-12 20:42:34 +0000 |
| commit | 8523b6bd0d22083266d990191764a0460885fd6e (patch) | |
| tree | 15e9d39366e769bd79c9d243d01f8c2d2db983c1 /src/core/SkStrikeCache.h | |
| parent | 047fb122b94d5a569a5b64f4e65ecc8bf68cf09c (diff) | |
fonts: Fix memory allocation for fallback glyphs.
When allocating the mask for a fallback glyph, we allocate it on the
arena on the SkScalerContext while the image belongs to a glyph on a
different cache. This can lead to use-after-free bugs if accessing the
image after the context owning that memory is destroyed. Fix this by
allocating on the arena from the owning cache.
R=herb@google.com, mtklein@google.com
Bug: 829622
Change-Id: Ife53e24f5bc868f36c43f2adcd7a2629ab5577fe
Reviewed-on: https://skia-review.googlesource.com/134182
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Mike Klein <mtklein@google.com>
Diffstat (limited to 'src/core/SkStrikeCache.h')
| -rw-r--r-- | src/core/SkStrikeCache.h | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/core/SkStrikeCache.h b/src/core/SkStrikeCache.h index da984cce13..05e3aa4025 100644 --- a/src/core/SkStrikeCache.h +++ b/src/core/SkStrikeCache.h @@ -70,8 +70,9 @@ public: static ExclusiveStrikePtr FindStrikeExclusive(const SkDescriptor&); - static bool DesperationSearchForImage( - const SkDescriptor& desc, SkGlyph* glyph, SkArenaAlloc* arena); + static bool DesperationSearchForImage(const SkDescriptor& desc, + SkGlyph* glyph, + SkGlyphCache* targetCache); static bool DesperationSearchForPath( const SkDescriptor& desc, SkGlyphID glyphID, SkPath* path); @@ -112,7 +113,9 @@ public: // Routines to find suitable data when working in a remote cache situation. These are // suitable as substitutes for similar calls in SkScalerContext. - bool desperationSearchForImage(const SkDescriptor& desc, SkGlyph* glyph, SkArenaAlloc* alloc); + bool desperationSearchForImage(const SkDescriptor& desc, + SkGlyph* glyph, + SkGlyphCache* targetCache); bool desperationSearchForPath(const SkDescriptor& desc, SkGlyphID glyphID, SkPath* path); void purgeAll(); // does not change budget |