Test for glyphs which straddle the edge of device space.

src/core/SkDraw.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkDraw.h"
 #include "SkBlitter.h"
 #include "SkCanvas.h"
@@ skipping 15 matching lines @@
 #include "SkTextMapStateProc.h"
 #include "SkTLazy.h"
 #include "SkUtils.h"
 #include "SkVertState.h"
 
 #include "SkAutoKern.h"
 #include "SkBitmapProcShader.h"
 #include "SkDrawProcs.h"
 #include "SkMatrixUtils.h"
 
-
 //#define TRACE_BITMAP_DRAWS
 
 
 /** Helper for allocating small blitters on the stack.
  */
 class SkAutoBlitterChoose : SkNoncopyable {
 public:
     SkAutoBlitterChoose() {
         fBlitter = NULL;
     }
@@ skipping 1390 matching lines @@
 
 // disable warning : local variable used without having been initialized
 #if defined _WIN32 && _MSC_VER >= 1300
 #pragma warning ( push )
 #pragma warning ( disable : 4701 )
 #endif
 
 //////////////////////////////////////////////////////////////////////////////
 
 static void D1G_RectClip(const SkDraw1Glyph& state, Sk48Dot16 fx, Sk48Dot16 fy, const SkGlyph& glyph) {
+    // Prevent glyphs from being drawn outside of or straddling the edge of device space.
+    if ((fx >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) ||
+        (fx >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/) ||
+        (fy >> 16) > INT_MAX - (INT16_MAX + UINT16_MAX) ||
+        (fy >> 16) < INT_MIN - (INT16_MIN + 0 /*UINT16_MIN*/))
+    {
+        return;
+    }
+
     int left = Sk48Dot16FloorToInt(fx);
     int top = Sk48Dot16FloorToInt(fy);
     SkASSERT(glyph.fWidth > 0 && glyph.fHeight > 0);
     SkASSERT((NULL == state.fClip && state.fAAClip) ||
              (state.fClip && NULL == state.fAAClip && state.fClip->isRect()));
 
     left += glyph.fLeft;
     top  += glyph.fTop;
 
     int right   = left + glyph.fWidth;
@@ skipping 803 matching lines @@
         mask->fImage = SkMask::AllocImage(size);
         memset(mask->fImage, 0, mask->computeImageSize());
     }
 
     if (SkMask::kJustComputeBounds_CreateMode != mode) {
         draw_into_mask(*mask, devPath, style);
     }
 
     return true;
 }