diff options
| author |  Matt Sarett <msarett@google.com> | 2017-01-13 13:58:57 -0500 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2017-01-13 19:49:19 +0000 |
| commit | c55bc9a8dd6e48a8b16f191d078022298737941a (patch) | |
| tree | 57972c2dadfa8de9980a08a0815a95b43c3a4696 /src/opts/SkRasterPipeline_opts.h | |
| parent | 3b830a9ea3bce9eba663ab95486cf153831cd29c (diff) | |
Fix out of bounds read in RP::load_tables_u16_be()
BUG=skia:
CQ_INCLUDE_TRYBOTS=skia.primary:Test-Ubuntu-GCC-GCE-CPU-AVX2-x86_64-Release-SKNX_NO_SIMD
Change-Id: I4f6dd002b03812d63bf62342c346ea21f6865466
Reviewed-on: https://skia-review.googlesource.com/7027
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Matt Sarett <msarett@google.com>
Diffstat (limited to 'src/opts/SkRasterPipeline_opts.h')
| -rw-r--r-- | src/opts/SkRasterPipeline_opts.h | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/opts/SkRasterPipeline_opts.h b/src/opts/SkRasterPipeline_opts.h index 41a10b9963..71a15c68a8 100644 --- a/src/opts/SkRasterPipeline_opts.h +++ b/src/opts/SkRasterPipeline_opts.h @@ -604,9 +604,15 @@ STAGE_CTX(load_tables, const LoadTablesContext*) { STAGE_CTX(load_tables_u16_be, const LoadTablesContext*) { auto ptr = (const uint64_t*)ctx->fSrc + x; + const void* src = ptr; + SkNx<N, uint64_t> px; + if (tail) { + px = load(tail, ptr); + src = &px; + } SkNh rh, gh, bh, ah; - SkNh::Load4(ptr, &rh, &gh, &bh, &ah); + SkNh::Load4(src, &rh, &gh, &bh, &ah); // ctx->fSrc is big-endian, so "& 0xff" grabs the 8 most significant bits of each component. r = gather(tail, ctx->fR, SkNx_cast<int>(rh & 0xff)); |