From 6b18d2471fc8bc2b917eec7ceba10a6b602b9f01 Mon Sep 17 00:00:00 2001 From: "fmalita@google.com" Date: Mon, 17 Dec 2012 16:27:34 +0000 Subject: Limit the maximum number of dash segments per path https://crbug.com/165432 In order to avoid trivial out-of-memory exploits, cap path dashing at 1000000 segments per path. R=reed@google.com BUG= Review URL: https://codereview.appspot.com/6948063 git-svn-id: http://skia.googlecode.com/svn/trunk@6845 2bbb7eff-a529-9590-31e7-b0007b416f81 --- tests/DrawPathTest.cpp | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'tests/DrawPathTest.cpp') diff --git a/tests/DrawPathTest.cpp b/tests/DrawPathTest.cpp index fdabd0198d..e8cfa54d36 100644 --- a/tests/DrawPathTest.cpp +++ b/tests/DrawPathTest.cpp @@ -241,6 +241,26 @@ static void test_infinite_dash(skiatest::Reporter* reporter) { REPORTER_ASSERT(reporter, true); } +// http://crbug.com/165432 +// Limit extreme dash path effects to avoid exhausting the system memory. +static void test_crbug_165432(skiatest::Reporter* reporter) { + SkPath path; + path.moveTo(0, 0); + path.lineTo(10000000, 0); + + SkScalar intervals[] = { 0.5f, 0.5f }; + SkDashPathEffect dash(intervals, 2, 0); + + SkPaint paint; + paint.setStyle(SkPaint::kStroke_Style); + paint.setPathEffect(&dash); + + SkPath filteredPath; + SkStrokeRec rec(paint); + REPORTER_ASSERT(reporter, !dash.filterPath(&filteredPath, path, &rec)); + REPORTER_ASSERT(reporter, filteredPath.isEmpty()); +} + static void TestDrawPath(skiatest::Reporter* reporter) { test_giantaa(reporter); test_bug533(reporter); @@ -251,6 +271,7 @@ static void TestDrawPath(skiatest::Reporter* reporter) { test_inversepathwithclip(reporter); // test_crbug131181(reporter); test_infinite_dash(reporter); + test_crbug_165432(reporter); } #include "TestClassDef.h" -- cgit v1.2.3