Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[skia] Remove mem contraint checks from textblob deserialize (#1407)

This commit is contained in:
Kevin Lubick 2018-05-09 12:17:03 -04:00 committed by jonathanmetzman
parent 8b756828bc
commit 0e022eb344
3 changed files with 4 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
projects/skia/Dockerfile
View File

@ -28,7 +28,7 @@ RUN git clone https://skia.googlesource.com/skia.git
# current directory for build script # current directory for build script
WORKDIR skia WORKDIR skia
RUN python tools/git-sync-deps RUN bin/sync
RUN wget -O $SRC/skia/image_filter_deserialize_seed_corpus.zip https://storage.googleapis.com/skia-fuzzer/oss-fuzz/image_filter_deserialize_seed_corpus.zip RUN wget -O $SRC/skia/image_filter_deserialize_seed_corpus.zip https://storage.googleapis.com/skia-fuzzer/oss-fuzz/image_filter_deserialize_seed_corpus.zip

6
projects/skia/build.sh
View File

@ -51,13 +51,13 @@ $SRC/depot_tools/gn gen out/Fuzz\
$SRC/depot_tools/ninja -C out/Fuzz_mem_constraints image_filter_deserialize \ $SRC/depot_tools/ninja -C out/Fuzz_mem_constraints image_filter_deserialize \
textblob_deserialize api_raster_n32_canvas api_raster_n32_canvas
$SRC/depot_tools/ninja -C out/Fuzz region_deserialize region_set_path \ $SRC/depot_tools/ninja -C out/Fuzz region_deserialize region_set_path \
path_deserialize image_decode animated_image_decode \ path_deserialize image_decode animated_image_decode \
api_draw_functions api_gradients api_image_filter \ api_draw_functions api_gradients api_image_filter \
api_path_measure api_null_canvas png_encoder \ api_path_measure api_null_canvas png_encoder \
jpeg_encoder webp_encoder skottie_json jpeg_encoder webp_encoder skottie_json textblob_deserialize
cp out/Fuzz/region_deserialize $OUT/region_deserialize cp out/Fuzz/region_deserialize $OUT/region_deserialize
cp ./region_deserialize.options $OUT/region_deserialize.options cp ./region_deserialize.options $OUT/region_deserialize.options
@ -66,7 +66,7 @@ cp out/Fuzz/region_set_path $OUT/region_set_path
cp ./region_set_path.options $OUT/region_set_path.options cp ./region_set_path.options $OUT/region_set_path.options
cp ./region_set_path_seed_corpus.zip $OUT/region_set_path_seed_corpus.zip cp ./region_set_path_seed_corpus.zip $OUT/region_set_path_seed_corpus.zip
cp out/Fuzz_mem_constraints/textblob_deserialize $OUT/textblob_deserialize cp out/Fuzz/textblob_deserialize $OUT/textblob_deserialize
cp ./textblob_deserialize.options $OUT/textblob_deserialize.options cp ./textblob_deserialize.options $OUT/textblob_deserialize.options
cp ./textblob_deserialize_seed_corpus.zip $OUT/textblob_deserialize_seed_corpus.zip cp ./textblob_deserialize_seed_corpus.zip $OUT/textblob_deserialize_seed_corpus.zip

30
projects/skia/skia.diff
View File

@ -250,36 +250,6 @@ index 2373e62d46..410fa8a276 100644
if (0 == (dLeft | dRite)) { if (0 == (dLeft | dRite)) {
int L = SkFixedRoundToInt(left); int L = SkFixedRoundToInt(left);
int R = SkFixedRoundToInt(rite); int R = SkFixedRoundToInt(rite);
diff --git a/src/core/SkTextBlob.cpp b/src/core/SkTextBlob.cpp
index e2d3be4518..239ab7fb36 100644
--- a/src/core/SkTextBlob.cpp
+++ b/src/core/SkTextBlob.cpp
@@ -799,7 +799,11 @@ sk_sp<SkTextBlob> SkTextBlob::MakeFromBuffer(SkReadBuffer& reader) {
// End-of-runs marker.
break;
}
-
+#if defined(IS_FUZZING)
+ if (glyphCount > 1000) {
+ return nullptr;
+ }
+#endif
PositioningAndExtended pe;
pe.intValue = reader.read32();
GlyphPositioning pos = pe.positioning;
@@ -810,7 +814,11 @@ sk_sp<SkTextBlob> SkTextBlob::MakeFromBuffer(SkReadBuffer& reader) {
if (textSize < 0 || static_cast<size_t>(textSize) > reader.size()) {
return nullptr;
}
-
+#if defined(IS_FUZZING)
+ if (textSize > 1000) {
+ return nullptr;
+ }
+#endif
SkPoint offset;
reader.readPoint(&offset);
SkPaint font;
diff --git a/src/effects/Sk1DPathEffect.cpp b/src/effects/Sk1DPathEffect.cpp diff --git a/src/effects/Sk1DPathEffect.cpp b/src/effects/Sk1DPathEffect.cpp
index 57f2d2b6ce..186ce5d25b 100644 index 57f2d2b6ce..186ce5d25b 100644
--- a/src/effects/Sk1DPathEffect.cpp --- a/src/effects/Sk1DPathEffect.cpp