limit the number of points in SkDashPathEffect::asPoints

If the length of a line path is sufficiently long relative to the dash
interval, it is possible to cause SkDashPathEffect::asPoints to produce
so many points that it overflows the amount that can fit in an int type,
or otherwise produce non-finite values, i.e. path from (0,0) to (0,9e15)
with a dash interval of 1.

This fixes that by capping the amount of points to a sane limit - in this
case, 1mil, since that limit is also used in utils/SkDashPath.cpp and has
precedent.

Downstream Firefox bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1287515

BUG=skia:
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2165013002

Review-Url: https://codereview.chromium.org/2165013002

1 files changed, 16 insertions, 0 deletions

diff --git a/tests/DashPathEffectTest.cpp b/tests/DashPathEffectTest.cpp
index 7e832cdd66..e3a380411d 100644
--- a/tests/DashPathEffectTest.cpp
+++ b/tests/DashPathEffectTest.cpp
@@ -10,6 +10,8 @@
 #include "SkDashPathEffect.h"
 #include "SkWriteBuffer.h"
 #include "SkStrokeRec.h"
+#include "SkCanvas.h"
+#include "SkSurface.h"
 
 // crbug.com/348821 was rooted in SkDashPathEffect refusing to flatten and unflatten itself when
 // the effect is nonsense.  Here we test that it fails when passed nonsense parameters.
@@ -99,3 +101,17 @@ DEF_TEST(DashPath_bug4871, r) {
     SkPath fill;
     paint.getFillPath(path, &fill);
 }
+
+// Verify that long lines with many dashes don't cause overflows/OOMs.
+DEF_TEST(DashPathEffectTest_asPoints_limit, r) {
+    sk_sp<SkSurface> surface(SkSurface::MakeRaster(SkImageInfo::MakeN32Premul(256, 256)));
+    SkCanvas* canvas = surface->getCanvas();
+
+    SkPaint p;
+    p.setStyle(SkPaint::kStroke_Style);
+    // force the bounds to outset by a large amount
+    p.setStrokeWidth(5.0e10f);
+    const SkScalar intervals[] = { 1, 1 };
+    p.setPathEffect(SkDashPathEffect::Make(intervals, SK_ARRAY_COUNT(intervals), 0));
+    canvas->drawLine(1, 1, 1, 5.0e10f, p);
+}