aboutsummaryrefslogtreecommitdiffhomepage
path: root/src/core
diff options
context:
space:
mode:
authorGravatar bungeman <bungeman@google.com>2015-03-16 09:49:54 -0700
committerGravatar Commit bot <commit-bot@chromium.org>2015-03-16 09:49:54 -0700
commitd095f2bf06ca810844233bea9fb06de585643b32 (patch)
tree9a9cc4fdbfb55b19aa0c920b28b2b81f1f9a089b /src/core
parentfdc310855dbf04ffb33787f5c0d76fef90b303d4 (diff)
Test for glyphs which straddle the edge of device space.
If a glyph ends up with a left edge near the extreme right edge of device space, the right edge may end up at the extreme left. The current clip tests do not test for this situation and attempt to draw the glyphs. This results in the blitters never reaching the right edge of the glyph and so reading from other memory. BUG=chromium:467011 Review URL: https://codereview.chromium.org/1012763002
Diffstat (limited to 'src/core')
-rw-r--r--src/core/SkDraw.cpp10
1 files changed, 9 insertions, 1 deletions
diff --git a/src/core/SkDraw.cpp b/src/core/SkDraw.cpp
index ef268bfed3..bbe99f5570 100644
--- a/src/core/SkDraw.cpp
+++ b/src/core/SkDraw.cpp
@@ -33,7 +33,6 @@
#include "SkDrawProcs.h"
#include "SkMatrixUtils.h"
-
//#define TRACE_BITMAP_DRAWS
@@ -1444,6 +1443,15 @@ void SkDraw::drawText_asPaths(const char text[], size_t byteLength,
//////////////////////////////////////////////////////////////////////////////
static void D1G_RectClip(const SkDraw1Glyph& state, Sk48Dot16 fx, Sk48Dot16 fy, const SkGlyph& glyph) {
+ // Prevent glyphs from being drawn outside of or straddling the edge of device space.
+ if ((fx >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) ||
+ (fx >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/) ||
+ (fy >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) ||
+ (fy >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/))
+ {
+ return;
+ }
+
int left = Sk48Dot16FloorToInt(fx);
int top = Sk48Dot16FloorToInt(fy);
SkASSERT(glyph.fWidth > 0 && glyph.fHeight > 0);