diff options
| author |  robertphillips <robertphillips@google.com> | 2016-06-28 04:54:54 -0700 |
|---|---|---|
| committer |  Commit bot <commit-bot@chromium.org> | 2016-06-28 04:54:54 -0700 |
| commit | 7070a3c44b24da5715dc4da618cb014f87e92451 (patch) | |
| tree | dc1668fb880c660c0d0771b713e5829e7feec74f /src | |
| parent | f9bd9da14a668008b3cff9ef69ebf50962e4fd44 (diff) | |
Fix mask applied to SkPath::fFillType in readFromMemory to fix fuzzer bug
The fFillType field only needs/uses 2 bits - not all 8
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2099113004
Review-Url: https://codereview.chromium.org/2099113004
Diffstat (limited to 'src')
| -rw-r--r-- | src/core/SkPath.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp index f5b53fcc00..50789b42eb 100644 --- a/src/core/SkPath.cpp +++ b/src/core/SkPath.cpp @@ -2058,7 +2058,7 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) { } fConvexity = (packed >> kConvexity_SerializationShift) & 0xFF; - fFillType = (packed >> kFillType_SerializationShift) & 0xFF; + fFillType = (packed >> kFillType_SerializationShift) & 0x3; uint8_t dir = (packed >> kDirection_SerializationShift) & 0x3; fIsVolatile = (packed >> kIsVolatile_SerializationShift) & 0x1; SkPathRef* pathRef = SkPathRef::CreateFromBuffer(&buffer); |