limit crash small steps in 1dpatheffect

Bug: oss-fuzz:6590
Change-Id: Ib7b6f4d25712e462ca45284cf6fc8fd73aa92880
Reviewed-on: https://skia-review.googlesource.com/110640
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/src/effects/Sk1DPathEffect.cpp b/src/effects/Sk1DPathEffect.cpp
index 3c1291a0cb..f73e0768c7 100644
--- a/src/effects/Sk1DPathEffect.cpp
+++ b/src/effects/Sk1DPathEffect.cpp
@@ -12,13 +12,18 @@
 #include "SkPathMeasure.h"
 #include "SkStrokeRec.h"
 
+// Since we are stepping by a float, the do/while loop might go on forever (or nearly so).
+// Put in a governor to limit crash values from looping too long (and allocating too much ram).
+#define MAX_REASONABLE_ITERATIONS   100000
+
 bool Sk1DPathEffect::filterPath(SkPath* dst, const SkPath& src,
                                 SkStrokeRec*, const SkRect*) const {
     SkPathMeasure   meas(src, false);
     do {
+        int governor = MAX_REASONABLE_ITERATIONS;
         SkScalar    length = meas.getLength();
         SkScalar    distance = this->begin(length);
-        while (distance < length) {
+        while (distance < length && --governor >= 0) {
             SkScalar delta = this->next(dst, distance, meas);
             if (delta <= 0) {
                 break;