diff options
| author |  Mike Klein <mtklein@chromium.org> | 2017-10-11 17:13:28 -0400 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2017-10-12 15:29:11 +0000 |
| commit | 20d479c088ad6dc06e16b13a3e6b2dfefa845430 (patch) | |
| tree | 53913c9a5f80b1a41896164952535d808c0f3c3c /src/core | |
| parent | 298143ebdfd55f83c7493760bf3d844a4ac8325a (diff) | |
abort SkRRect::transform() before dst->scaleRadii() asserts
If we've got a crazy matrix, we can make dst arbitrarily crazy.
This should fix several of Kevin's fuzzes, e.g.
Bug: skia:7090
I don't see any uses of SkRRect::transform() that care about
the output rrect in case of failure, so I've just removed the
guarantee that we don't modify it when failing.
Change-Id: I4c81af59a093a984f0a02a0d3dc4bbbb1fb935f2
Reviewed-on: https://skia-review.googlesource.com/58620
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/SkRRect.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/core/SkRRect.cpp b/src/core/SkRRect.cpp index f2c57982f0..9b3d70e1fd 100644 --- a/src/core/SkRRect.cpp +++ b/src/core/SkRRect.cpp @@ -426,6 +426,10 @@ bool SkRRect::transform(const SkMatrix& matrix, SkRRect* dst) const { SkTSwap(dst->fRadii[kUpperRight_Corner], dst->fRadii[kLowerRight_Corner]); } + if (!AreRectAndRadiiValid(dst->fRect, dst->fRadii)) { + return false; + } + dst->scaleRadii(); return true; |