diff options
author | Robert Phillips <robertphillips@google.com> | 2018-01-23 09:58:18 -0500 |
---|---|---|
committer | Skia Commit-Bot <skia-commit-bot@chromium.org> | 2018-01-23 19:54:00 +0000 |
commit | bee273291f735248f6a2018aeb29a82e7584eaf7 (patch) | |
tree | df59428ae1018ce46d55639684c9a550c63cf5be /src/shaders/SkPerlinNoiseShader.cpp | |
parent | 8d4a9f01f672cf78246e5ea4fcb5f04bffce84a2 (diff) |
Fix some fuzzer bugs from Skia's image filter fuzzer
Change-Id: I432b3a351eecca0d36635e37f91d32c0e281b7d9
Reviewed-on: https://skia-review.googlesource.com/98384
Commit-Queue: Robert Phillips <robertphillips@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
Reviewed-by: Mike Reed <reed@google.com>
Diffstat (limited to 'src/shaders/SkPerlinNoiseShader.cpp')
-rw-r--r-- | src/shaders/SkPerlinNoiseShader.cpp | 35 |
1 files changed, 24 insertions, 11 deletions
diff --git a/src/shaders/SkPerlinNoiseShader.cpp b/src/shaders/SkPerlinNoiseShader.cpp index ba85a8b7ae..0a15f1ce44 100644 --- a/src/shaders/SkPerlinNoiseShader.cpp +++ b/src/shaders/SkPerlinNoiseShader.cpp @@ -12,6 +12,7 @@ #include "SkColorFilter.h" #include "SkMakeUnique.h" #include "SkReadBuffer.h" +#include "SkSafeRange.h" #include "SkWriteBuffer.h" #include "SkShader.h" #include "SkUnPreMultiply.h" @@ -321,10 +322,11 @@ public: kFractalNoise_Type, kTurbulence_Type, kImprovedNoise_Type, - kFirstType = kFractalNoise_Type, - kLastType = kImprovedNoise_Type + kLast_Type = kImprovedNoise_Type }; + static const int kMaxOctaves = 255; // numOctaves must be <= 0 and <= kMaxOctaves + SkPerlinNoiseShaderImpl(SkPerlinNoiseShaderImpl::Type type, SkScalar baseFrequencyX, SkScalar baseFrequencyY, int numOctaves, SkScalar seed, const SkISize* tileSize); @@ -397,32 +399,41 @@ inline SkScalar smoothCurve(SkScalar t) { } // end namespace SkPerlinNoiseShaderImpl::SkPerlinNoiseShaderImpl(SkPerlinNoiseShaderImpl::Type type, - SkScalar baseFrequencyX, - SkScalar baseFrequencyY, - int numOctaves, - SkScalar seed, - const SkISize* tileSize) + SkScalar baseFrequencyX, + SkScalar baseFrequencyY, + int numOctaves, + SkScalar seed, + const SkISize* tileSize) : fType(type) , fBaseFrequencyX(baseFrequencyX) , fBaseFrequencyY(baseFrequencyY) - , fNumOctaves(numOctaves > 255 ? 255 : numOctaves/*[0,255] octaves allowed*/) + , fNumOctaves(numOctaves > kMaxOctaves ? kMaxOctaves : numOctaves/*[0,255] octaves allowed*/) , fSeed(seed) , fTileSize(nullptr == tileSize ? SkISize::Make(0, 0) : *tileSize) , fStitchTiles(!fTileSize.isEmpty()) { - SkASSERT(numOctaves >= 0 && numOctaves < 256); + SkASSERT(numOctaves >= 0 && numOctaves <= kMaxOctaves); } sk_sp<SkFlattenable> SkPerlinNoiseShaderImpl::CreateProc(SkReadBuffer& buffer) { - Type type = (Type)buffer.readInt(); + SkSafeRange safe; + + Type type = safe.checkLE<Type>(buffer.readInt(), kLast_Type); + SkScalar freqX = buffer.readScalar(); SkScalar freqY = buffer.readScalar(); - int octaves = buffer.readInt(); + + int octaves = safe.checkLE<int>(buffer.readInt(), kMaxOctaves); + SkScalar seed = buffer.readScalar(); SkISize tileSize; tileSize.fWidth = buffer.readInt(); tileSize.fHeight = buffer.readInt(); + if (!buffer.validate(safe)) { + return nullptr; + } + switch (type) { case kFractalNoise_Type: return SkPerlinNoiseShader::MakeFractalNoise(freqX, freqY, octaves, seed, &tileSize); @@ -431,6 +442,8 @@ sk_sp<SkFlattenable> SkPerlinNoiseShaderImpl::CreateProc(SkReadBuffer& buffer) { case kImprovedNoise_Type: return SkPerlinNoiseShader::MakeImprovedNoise(freqX, freqY, octaves, seed); default: + // Really shouldn't get here b.c. of earlier checkLE on type + buffer.validate(false); return nullptr; } } |