diff --git a/src/gpu/ganesh/ops/DashOp.cpp b/src/gpu/ganesh/ops/DashOp.cpp index 15ff5887e67e4fdb84cc1eaa3404fa4820164298..cbe780764754994db5cb6839a1de20ccc6deed9d 100644 --- a/src/gpu/ganesh/ops/DashOp.cpp +++ b/src/gpu/ganesh/ops/DashOp.cpp @@ -8,6 +8,7 @@ #include "src/gpu/ganesh/ops/DashOp.h" #include "include/gpu/GrRecordingContext.h" +#include "src/base/SkSafeMath.h" #include "src/core/SkMatrixPriv.h" #include "src/core/SkPointPriv.h" #include "src/gpu/BufferWriter.h" @@ -354,6 +355,7 @@ private: STArray rects; STArray draws; + SkSafeMath safeMath; int totalRectCount = 0; int rectOffset = 0; rects.push_back_n(3 * instanceCount); @@ -520,9 +522,9 @@ private: devIntervals[0] = lineLength; } - totalRectCount += !lineDone ? 1 : 0; - totalRectCount += hasStartRect ? 1 : 0; - totalRectCount += hasEndRect ? 1 : 0; + totalRectCount = safeMath.addInt(totalRectCount, !lineDone ? 1 : 0); + totalRectCount = safeMath.addInt(totalRectCount, hasStartRect ? 1 : 0); + totalRectCount = safeMath.addInt(totalRectCount, hasEndRect ? 1 : 0); if (SkPaint::kRound_Cap == cap && 0 != args.fSrcStrokeWidth) { // need to adjust this for round caps to correctly set the dashPos attrib on @@ -562,7 +564,7 @@ private: draw.fHasEndRect = hasEndRect; } - if (!totalRectCount) { + if (!totalRectCount || !safeMath) { return; } diff --git a/src/gpu/ganesh/ops/DrawAtlasOp.cpp b/src/gpu/ganesh/ops/DrawAtlasOp.cpp index 10eb8b006e044e27f4b2703dbc584629baac1889..776587d3e29112187056939f4a7902b7174a1ad9 100644 --- a/src/gpu/ganesh/ops/DrawAtlasOp.cpp +++ b/src/gpu/ganesh/ops/DrawAtlasOp.cpp @@ -10,6 +10,7 @@ #include "include/core/SkRSXform.h" #include "include/gpu/GrRecordingContext.h" #include "src/base/SkRandom.h" +#include "src/base/SkSafeMath.h" #include "src/core/SkMatrixPriv.h" #include "src/core/SkRectPriv.h" #include "src/gpu/ganesh/GrCaps.h" @@ -280,8 +281,14 @@ GrOp::CombineResult DrawAtlasOpImpl::onCombineIfPossible(GrOp* t, return CombineResult::kCannotCombine; } + SkSafeMath safeMath; + int newQuadCount = safeMath.addInt(fQuadCount, that->quadCount()); + if (!safeMath) { + return CombineResult::kCannotCombine; + } + fGeoData.push_back_n(that->fGeoData.size(), that->fGeoData.begin()); - fQuadCount += that->quadCount(); + fQuadCount = newQuadCount; return CombineResult::kMerged; } diff --git a/src/gpu/ganesh/ops/GrMeshDrawOp.cpp b/src/gpu/ganesh/ops/GrMeshDrawOp.cpp index 4fdf90b0381996609773e952674aad149b29b98d..5b885f0fd1cae6602d7f0982b91cc2a0af7a8b3b 100644 --- a/src/gpu/ganesh/ops/GrMeshDrawOp.cpp +++ b/src/gpu/ganesh/ops/GrMeshDrawOp.cpp @@ -7,6 +7,7 @@ #include "src/gpu/ganesh/ops/GrMeshDrawOp.h" +#include "include/private/base/SkMath.h" #include "src/gpu/ganesh/GrOpFlushState.h" #include "src/gpu/ganesh/GrOpsRenderPass.h" #include "src/gpu/ganesh/GrRecordingContextPriv.h" @@ -81,6 +82,12 @@ void GrMeshDrawOp::PatternHelper::init(GrMeshDrawTarget* target, GrPrimitiveType if (!indexBuffer) { return; } + + // Bail out when we get overflow from really large draws. + if (repeatCount < 0 || repeatCount > SK_MaxS32 / verticesPerRepetition) { + return; + } + sk_sp vertexBuffer; int firstVertex; int vertexCount = verticesPerRepetition * repeatCount; diff --git a/src/gpu/ganesh/ops/LatticeOp.cpp b/src/gpu/ganesh/ops/LatticeOp.cpp index b9cb45d833fffc88cc7ee7c51c42042d6d23c259..dc75036c8e8820d080cba0cd44427a0b3319c829 100644 --- a/src/gpu/ganesh/ops/LatticeOp.cpp +++ b/src/gpu/ganesh/ops/LatticeOp.cpp @@ -9,6 +9,7 @@ #include "include/core/SkBitmap.h" #include "include/core/SkRect.h" +#include "src/base/SkSafeMath.h" #include "src/core/SkLatticeIter.h" #include "src/core/SkMatrixPriv.h" #include "src/gpu/BufferWriter.h" @@ -240,11 +241,13 @@ private: int patchCnt = fPatches.size(); int numRects = 0; + + SkSafeMath safeMath; for (int i = 0; i < patchCnt; i++) { - numRects += fPatches[i].fIter->numRectsToDraw(); + numRects = safeMath.addInt(numRects, fPatches[i].fIter->numRectsToDraw()); } - if (!numRects) { + if (!numRects || !safeMath) { return; }