From 4514d5145515b76812b7950c153a834dc70a27fa Mon Sep 17 00:00:00 2001 From: Hermet Park Date: Tue, 24 Aug 2021 15:04:06 +0900 Subject: [PATCH] sw_engine shape: prevent crash when wrong pair of commands & points. add an exception handling, if the given points count is not matched with expected points count from commands. @Issue: https://github.com/Samsung/thorvg/issues/735 --- src/lib/sw_engine/tvgSwShape.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/lib/sw_engine/tvgSwShape.cpp b/src/lib/sw_engine/tvgSwShape.cpp index 4ccbff6..ecdaae1 100644 --- a/src/lib/sw_engine/tvgSwShape.cpp +++ b/src/lib/sw_engine/tvgSwShape.cpp @@ -389,11 +389,13 @@ static bool _genOutline(SwShape* shape, const Shape* sdata, const Matrix* transf //smart reservation auto outlinePtsCnt = 0; auto outlineCntrsCnt = 0; + auto closeCnt = 0; for (uint32_t i = 0; i < cmdCnt; ++i) { switch(*(cmds + i)) { case PathCommand::Close: { ++outlinePtsCnt; + ++closeCnt; break; } case PathCommand::MoveTo: { @@ -412,6 +414,11 @@ static bool _genOutline(SwShape* shape, const Shape* sdata, const Matrix* transf } } + if (static_cast(outlinePtsCnt - closeCnt) > ptsCnt) { + TVGERR("SW_ENGINE", "Wrong a pair of the commands & points - required(%d), current(%d)", outlinePtsCnt - closeCnt, ptsCnt); + return false; + } + ++outlinePtsCnt; //for close ++outlineCntrsCnt; //for end -- 2.7.4