From 92d976c3ad06d4a398d7bf95d2060e40154c39d7 Mon Sep 17 00:00:00 2001 From: fmalita Date: Mon, 5 Oct 2015 11:09:57 -0700 Subject: Validate text blob runs after SkTextBlob construction. This avoids tripping CFI when casting uninitialized SkTextBlob ptrs. BUG=chromium:538754 R=bungeman@google.com,reed@google.com,krasin@google.com Review URL: https://codereview.chromium.org/1388543005 --- src/core/SkTextBlob.cpp | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'src/core') diff --git a/src/core/SkTextBlob.cpp b/src/core/SkTextBlob.cpp index 68784f48b5..a49ff25101 100644 --- a/src/core/SkTextBlob.cpp +++ b/src/core/SkTextBlob.cpp @@ -157,7 +157,7 @@ public: + StorageSize(run->glyphCount(), run->positioning())); } - void validate(uint8_t* storageTop) const { + void validate(const uint8_t* storageTop) const { SkASSERT(kRunRecordMagic == fMagic); SkASSERT((uint8_t*)Next(this) <= storageTop); SkASSERT(glyphBuffer() + fCount <= (uint16_t*)posBuffer()); @@ -583,21 +583,20 @@ const SkTextBlob* SkTextBlobBuilder::build() { fStorage.realloc(fStorageUsed); } + const SkTextBlob* blob = new (fStorage.detach()) SkTextBlob(fRunCount, fBounds); + SkDEBUGCODE(const_cast(blob)->fStorageSize = fStorageSize;) + SkDEBUGCODE( size_t validateSize = sizeof(SkTextBlob); - const SkTextBlob::RunRecord* run = - SkTextBlob::RunRecord::First(reinterpret_cast(fStorage.get())); + const SkTextBlob::RunRecord* run = SkTextBlob::RunRecord::First(blob); for (int i = 0; i < fRunCount; ++i) { validateSize += SkTextBlob::RunRecord::StorageSize(run->fCount, run->fPositioning); - run->validate(fStorage.get() + fStorageUsed); + run->validate(reinterpret_cast(blob) + fStorageUsed); run = SkTextBlob::RunRecord::Next(run); } SkASSERT(validateSize == fStorageUsed); ) - const SkTextBlob* blob = new (fStorage.detach()) SkTextBlob(fRunCount, fBounds); - SkDEBUGCODE(const_cast(blob)->fStorageSize = fStorageSize;) - fStorageUsed = 0; fStorageSize = 0; fRunCount = 0; -- cgit v1.2.3