From aa7ceb62b51bfe1057c83b3475797ec7c82bc964 Mon Sep 17 00:00:00 2001 From: caryclark Date: Wed, 29 Jun 2016 10:46:08 -0700 Subject: [PATCH] fix another pathops fuzz bug Tunnel out the error case when the numerics create uncalculable angles. R=mmoroz@chromium.org TBR=reed@google.com BUG=624351 GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2103863005 Review-Url: https://codereview.chromium.org/2103863005 --- src/pathops/SkPathOpsCommon.cpp | 3 ++ src/pathops/SkPathOpsOp.cpp | 3 ++ tests/PathOpsOpTest.cpp | 66 +++++++++++++++++++++++++++++++++ 3 files changed, 72 insertions(+) diff --git a/src/pathops/SkPathOpsCommon.cpp b/src/pathops/SkPathOpsCommon.cpp index ec8e78d0cb..24ef6f1129 100644 --- a/src/pathops/SkPathOpsCommon.cpp +++ b/src/pathops/SkPathOpsCommon.cpp @@ -27,6 +27,9 @@ const SkOpAngle* AngleWinding(SkOpSpanBase* start, SkOpSpanBase* end, int* windi int winding = SK_MinS32; do { angle = angle->next(); + if (!angle) { + return nullptr; + } unorderable |= angle->unorderable(); if ((computeWinding = unorderable || (angle == firstAngle && loop))) { break; // if we get here, there's no winding, loop is unorderable diff --git a/src/pathops/SkPathOpsOp.cpp b/src/pathops/SkPathOpsOp.cpp index 25795047c8..1970eea124 100644 --- a/src/pathops/SkPathOpsOp.cpp +++ b/src/pathops/SkPathOpsOp.cpp @@ -36,6 +36,9 @@ static SkOpSegment* findChaseOp(SkTDArray& chase, SkOpSpanBase** int winding; bool sortable; const SkOpAngle* angle = AngleWinding(*startPtr, *endPtr, &winding, &sortable); + if (!angle) { + return nullptr; + } if (winding == SK_MinS32) { continue; } diff --git a/tests/PathOpsOpTest.cpp b/tests/PathOpsOpTest.cpp index f6d44101d1..e22a2166ee 100644 --- a/tests/PathOpsOpTest.cpp +++ b/tests/PathOpsOpTest.cpp @@ -5980,7 +5980,73 @@ path.cubicTo(SkBits2Float(0x3a293a2a), SkBits2Float(0x0e3bf0c5), SkBits2Float(0x testPathSkipAssertOp(reporter, path1, path2, (SkPathOp) 1, filename); } +static void fuzz763_5(skiatest::Reporter* reporter, const char* filename) { + SkPath path; + path.setFillType((SkPath::FillType) 1); + + SkPath path1(path); + path.reset(); + path.setFillType((SkPath::FillType) 0); +path.moveTo(SkBits2Float(0x5b292d55), SkBits2Float(0x2a2a8c55)); // 4.76191e+16f, 1.51477e-13f +path.conicTo(SkBits2Float(0xc0032108), SkBits2Float(0x7a6a4b79), SkBits2Float(0x212a8ced), SkBits2Float(0x0321081f), SkBits2Float(0x6a3a7bc0)); // -2.04889f, 3.04132e+35f, 5.77848e-19f, 4.7323e-37f, 5.63611e+25f +path.conicTo(SkBits2Float(0x3a2147ed), SkBits2Float(0xdf28282a), SkBits2Float(0x3a8a3a21), SkBits2Float(0x8a284f9a), SkBits2Float(0x3ac23ab3)); // 0.000615238f, -1.2117e+19f, 0.00105459f, -8.10388e-33f, 0.00148185f +path.cubicTo(SkBits2Float(0xe62a2928), SkBits2Float(0x2a63962b), SkBits2Float(0x68295b2d), SkBits2Float(0x2d296855), SkBits2Float(0x2a8c555b), SkBits2Float(0x001f2a21)); // -2.0089e+23f, 2.02138e-13f, 3.19905e+24f, 9.6297e-12f, 2.49282e-13f, 2.86201e-39f +path.lineTo(SkBits2Float(0x5b292d55), SkBits2Float(0x2a2a8c55)); // 4.76191e+16f, 1.51477e-13f +path.close(); +path.moveTo(SkBits2Float(0x5b292d55), SkBits2Float(0x2a2a8c55)); // 4.76191e+16f, 1.51477e-13f +path.conicTo(SkBits2Float(0x6a4b7bc0), SkBits2Float(0x2a8ced7a), SkBits2Float(0x21081f21), SkBits2Float(0x3a7bc003), SkBits2Float(0x47ed7a6a)); // 6.14991e+25f, 2.50338e-13f, 4.61198e-19f, 0.00096035f, 121589 +path.lineTo(SkBits2Float(0x5b292d55), SkBits2Float(0x2a2a8c55)); // 4.76191e+16f, 1.51477e-13f +path.close(); +path.moveTo(SkBits2Float(0x5b292d55), SkBits2Float(0x2a2a8c55)); // 4.76191e+16f, 1.51477e-13f +path.quadTo(SkBits2Float(0xdf28282a), SkBits2Float(0x3a8a3b21), SkBits2Float(0x28ee4f9a), SkBits2Float(0x68293b78)); // -1.2117e+19f, 0.00105462f, 2.64578e-14f, 3.19671e+24f +path.lineTo(SkBits2Float(0x5b2d2968), SkBits2Float(0x5b2d8c55)); // 4.87407e+16f, 4.88495e+16f + + SkPath path2(path); + testPathSkipAssertOp(reporter, path1, path2, (SkPathOp) 4, filename); +} + +static void fuzz763_2(skiatest::Reporter* reporter, const char* filename) { + SkPath path; + path.setFillType((SkPath::FillType) 1); + + SkPath path1(path); + path.reset(); + path.setFillType((SkPath::FillType) 0); +path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000)); // 0, 0 +path.lineTo(SkBits2Float(0x555b292d), SkBits2Float(0x2a212a8c)); // 1.50606e+13f, 1.43144e-13f +path.conicTo(SkBits2Float(0xc0032108), SkBits2Float(0x7a6a4b7b), SkBits2Float(0x212a8ced), SkBits2Float(0x0321081f), SkBits2Float(0x6a3a7bc0)); // -2.04889f, 3.04132e+35f, 5.77848e-19f, 4.7323e-37f, 5.63611e+25f +path.lineTo(SkBits2Float(0x081f2ad7), SkBits2Float(0x7bc00321)); // 4.78977e-34f, 1.99397e+36f +path.moveTo(SkBits2Float(0x2a3a2147), SkBits2Float(0xdf212828)); // 1.65317e-13f, -1.16126e+19f +path.quadTo(SkBits2Float(0x4f1a3a8a), SkBits2Float(0x3ab38a28), SkBits2Float(0x29283ac2), SkBits2Float(0x962be62a)); // 2.58753e+09f, 0.00136978f, 3.73545e-14f, -1.38859e-25f +path.cubicTo(SkBits2Float(0x272a812a), SkBits2Float(0x3a2a5529), SkBits2Float(0x3b1e2ab0), SkBits2Float(0x29272021), SkBits2Float(0x3b3ac527), SkBits2Float(0x1fc42237)); // 2.36623e-15f, 0.000649768f, 0.00241343f, 3.71093e-14f, 0.00284989f, 8.30658e-20f +path.cubicTo(SkBits2Float(0x27576c2a), SkBits2Float(0x5921c25d), SkBits2Float(0x51523a70), SkBits2Float(0x12102a10), SkBits2Float(0x633a28d9), SkBits2Float(0x29c80927)); // 2.98959e-15f, 2.8457e+15f, 5.64327e+10f, 4.54902e-28f, 3.43404e+21f, 8.88337e-14f +path.lineTo(SkBits2Float(0x29292727), SkBits2Float(0x21475b3b)); // 3.75595e-14f, 6.75446e-19f +path.quadTo(SkBits2Float(0xdf28282a), SkBits2Float(0x3a8a3a21), SkBits2Float(0x8a284f9a), SkBits2Float(0x3ac23ab3)); // -1.2117e+19f, 0.00105459f, -8.10388e-33f, 0.00148185f +path.cubicTo(SkBits2Float(0x682d2928), SkBits2Float(0x555b6829), SkBits2Float(0x555b292d), SkBits2Float(0x2a212a8c), SkBits2Float(0x0321081f), SkBits2Float(0x6a4b7bc0)); // 3.27091e+24f, 1.50775e+13f, 1.50606e+13f, 1.43144e-13f, 4.7323e-37f, 6.14991e+25f +path.conicTo(SkBits2Float(0x295b2ded), SkBits2Float(0x29685568), SkBits2Float(0x8c555b2d), SkBits2Float(0xe61d2a2a), SkBits2Float(0x2a63962b)); // 4.86676e-14f, 5.15884e-14f, -1.64364e-31f, -1.85547e+23f, 2.02138e-13f +path.conicTo(SkBits2Float(0x5568295b), SkBits2Float(0x5b2d2968), SkBits2Float(0x212a8c55), SkBits2Float(0x21081f2a), SkBits2Float(0x4b7bc003)); // 1.5954e+13f, 4.87407e+16f, 5.7784e-19f, 4.61198e-19f, 1.64987e+07f +path.lineTo(SkBits2Float(0x2a8ced7a), SkBits2Float(0x21081f21)); // 2.50338e-13f, 4.61198e-19f +path.conicTo(SkBits2Float(0x6a3a7bc0), SkBits2Float(0x2147ed7a), SkBits2Float(0x28282a3a), SkBits2Float(0x8a3a21df), SkBits2Float(0x27b42a3a)); // 5.63611e+25f, 6.77381e-19f, 9.33503e-15f, -8.96194e-33f, 5.00058e-15f +path.conicTo(SkBits2Float(0x2921217d), SkBits2Float(0x5e3a3b35), SkBits2Float(0x7828ee3a), SkBits2Float(0x8e28b03b), SkBits2Float(0x783be82a)); // 3.57782e-14f, 3.35484e+18f, 1.37053e+34f, -2.07925e-30f, 1.52448e+34f +path.conicTo(SkBits2Float(0x8e0b8a3a), SkBits2Float(0x279fd4e6), SkBits2Float(0x7a293a2a), SkBits2Float(0x2a0ef0c5), SkBits2Float(0x653b29d4)); // -1.71996e-30f, 4.43622e-15f, 2.19669e+35f, 1.26957e-13f, 5.52409e+22f +path.quadTo(SkBits2Float(0x29210f21), SkBits2Float(0x282a085d), SkBits2Float(0xc2ab2127), SkBits2Float(0xa6800028)); // 3.57623e-14f, 9.43871e-15f, -85.5648f, -8.88183e-16f +path.lineTo(SkBits2Float(0x2a3a2147), SkBits2Float(0xdf212828)); // 1.65317e-13f, -1.16126e+19f +path.close(); +path.moveTo(SkBits2Float(0x2a3a2147), SkBits2Float(0xdf212828)); // 1.65317e-13f, -1.16126e+19f +path.quadTo(SkBits2Float(0x216a2770), SkBits2Float(0x2ab73b28), SkBits2Float(0x4b28f427), SkBits2Float(0x283b5b28)); // 7.93345e-19f, 3.25484e-13f, 1.10726e+07f, 1.04004e-14f +path.lineTo(SkBits2Float(0x2a3a2147), SkBits2Float(0xdf212828)); // 1.65317e-13f, -1.16126e+19f +path.close(); +path.moveTo(SkBits2Float(0x2a3a2147), SkBits2Float(0xdf212828)); // 1.65317e-13f, -1.16126e+19f +path.conicTo(SkBits2Float(0xf86d273b), SkBits2Float(0x27e523e3), SkBits2Float(0x2927e0f5), SkBits2Float(0x2ac0e729), SkBits2Float(0x6b492128)); // -1.92402e+34f, 6.35992e-15f, 3.72766e-14f, 3.42665e-13f, 2.43151e+26f +path.cubicTo(SkBits2Float(0x2f273927), SkBits2Float(0xa83a2c21), SkBits2Float(0xd7122121), SkBits2Float(0x21212921), SkBits2Float(0x3be3db3a), SkBits2Float(0xa9deb63b)); // 1.52089e-10f, -1.03346e-14f, -1.60671e+14f, 5.46034e-19f, 0.00695362f, -9.89039e-14f + + SkPath path2(path); + testPathSkipAssertOp(reporter, path1, path2, (SkPathOp) 1, filename); +} + static struct TestDesc failTests[] = { + TEST(fuzz763_2), + TEST(fuzz763_5), TEST(fuzz763_3), TEST(fuzz763_4), TEST(fuzz763_9), -- 2.34.1