diff options
| author |  bungeman <bungeman@google.com> | 2015-03-16 09:49:54 -0700 |
|---|---|---|
| committer |  Commit bot <commit-bot@chromium.org> | 2015-03-16 09:49:54 -0700 |
| commit | d095f2bf06ca810844233bea9fb06de585643b32 (patch) | |
| tree | 9a9cc4fdbfb55b19aa0c920b28b2b81f1f9a089b /src | |
| parent | fdc310855dbf04ffb33787f5c0d76fef90b303d4 (diff) | |
Test for glyphs which straddle the edge of device space.
If a glyph ends up with a left edge near the extreme right edge of
device space, the right edge may end up at the extreme left. The
current clip tests do not test for this situation and attempt to
draw the glyphs. This results in the blitters never reaching the
right edge of the glyph and so reading from other memory.
BUG=chromium:467011
Review URL: https://codereview.chromium.org/1012763002
Diffstat (limited to 'src')
| -rw-r--r-- | src/core/SkDraw.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/core/SkDraw.cpp b/src/core/SkDraw.cpp index ef268bfed3..bbe99f5570 100644 --- a/src/core/SkDraw.cpp +++ b/src/core/SkDraw.cpp @@ -33,7 +33,6 @@ #include "SkDrawProcs.h" #include "SkMatrixUtils.h" - //#define TRACE_BITMAP_DRAWS @@ -1444,6 +1443,15 @@ void SkDraw::drawText_asPaths(const char text[], size_t byteLength, ////////////////////////////////////////////////////////////////////////////// static void D1G_RectClip(const SkDraw1Glyph& state, Sk48Dot16 fx, Sk48Dot16 fy, const SkGlyph& glyph) { + // Prevent glyphs from being drawn outside of or straddling the edge of device space. + if ((fx >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) || + (fx >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/) || + (fy >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) || + (fy >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/)) + { + return; + } + int left = Sk48Dot16FloorToInt(fx); int top = Sk48Dot16FloorToInt(fy); SkASSERT(glyph.fWidth > 0 && glyph.fHeight > 0); |