From d095f2bf06ca810844233bea9fb06de585643b32 Mon Sep 17 00:00:00 2001 From: bungeman Date: Mon, 16 Mar 2015 09:49:54 -0700 Subject: Test for glyphs which straddle the edge of device space. If a glyph ends up with a left edge near the extreme right edge of device space, the right edge may end up at the extreme left. The current clip tests do not test for this situation and attempt to draw the glyphs. This results in the blitters never reaching the right edge of the glyph and so reading from other memory. BUG=chromium:467011 Review URL: https://codereview.chromium.org/1012763002 --- src/core/SkDraw.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/core/SkDraw.cpp b/src/core/SkDraw.cpp index ef268bfed3..bbe99f5570 100644 --- a/src/core/SkDraw.cpp +++ b/src/core/SkDraw.cpp @@ -33,7 +33,6 @@ #include "SkDrawProcs.h" #include "SkMatrixUtils.h" - //#define TRACE_BITMAP_DRAWS @@ -1444,6 +1443,15 @@ void SkDraw::drawText_asPaths(const char text[], size_t byteLength, ////////////////////////////////////////////////////////////////////////////// static void D1G_RectClip(const SkDraw1Glyph& state, Sk48Dot16 fx, Sk48Dot16 fy, const SkGlyph& glyph) { + // Prevent glyphs from being drawn outside of or straddling the edge of device space. + if ((fx >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) || + (fx >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/) || + (fy >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) || + (fy >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/)) + { + return; + } + int left = Sk48Dot16FloorToInt(fx); int top = Sk48Dot16FloorToInt(fy); SkASSERT(glyph.fWidth > 0 && glyph.fHeight > 0); -- cgit v1.2.3