Gamma sanity checks

src/core/SkColorSpace.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorSpace.h"
 #include "SkColorSpace_Base.h"
 #include "SkEndian.h"
@@ skipping 409 matching lines @@
                 } else if (len < tagBytes) {
                     SkColorSpacePrintf("gamma tag is too small (%d bytes)", len);
                     return false;
                 }
 
                 const uint16_t* table = (const uint16_t*) (src + 12);
                 if (1 == count) {
                     // The table entry is the gamma (with a bias of 256).
                     uint16_t value = read_big_endian_short((const uint8_t*) table);
                     gammas[i].fValue = value / 256.0f;
+                    if (0.0f == gammas[i].fValue) {
+                        SkColorSpacePrintf("Cannot have zero gamma value");
+                        return false;
+                    }
                     SkColorSpacePrintf("gamma %d %g\n", value, gammas[i].fValue);
                     break;
                 }
 
                 // Check for frequently occurring curves and use a fast approximation.
                 // We do this by sampling a few values and see if they match our expectation.
                 // A more robust solution would be to compare each value in this curve against
                 // a 2.2f curve see if we remain below an error threshold.  At this time,
                 // we haven't seen any images in the wild that make this kind of
                 // calculation necessary.  We encounter identical gamma curves over and
@@ skipping 70 matching lines @@
                             tagBytes = 12 + 12;
                             if (len < tagBytes) {
                                 SkColorSpacePrintf("gamma tag is too small (%d bytes)", len);
                                 return false;
                             }
 
                             // Y = (aX + b)^g  for X >= -b/a
                             // Y = 0           otherwise
                             g = SkFixedToFloat(read_big_endian_int(src + 12));
                             a = SkFixedToFloat(read_big_endian_int(src + 16));
+                            if (0.0f == a) {
+                                return false;
+                            }
+
                             b = SkFixedToFloat(read_big_endian_int(src + 20));
                             d = -b / a;
                             break;
                         }
                         case 2:
                             tagBytes = 12 + 16;
                             if (len < tagBytes) {
                                 SkColorSpacePrintf("gamma tag is too small (%d bytes)", len);
                                 return false;
                             }
 
                             // Y = (aX + b)^g + c  for X >= -b/a
                             // Y = c               otherwise
                             g = SkFixedToFloat(read_big_endian_int(src + 12));
                             a = SkFixedToFloat(read_big_endian_int(src + 16));
+                            if (0.0f == a) {
+                                return false;
+                            }
+
                             b = SkFixedToFloat(read_big_endian_int(src + 20));
                             c = SkFixedToFloat(read_big_endian_int(src + 24));
                             d = -b / a;
                             f = c;
                             break;
                         case 3:
                             tagBytes = 12 + 20;
                             if (len < tagBytes) {
                                 SkColorSpacePrintf("gamma tag is too small (%d bytes)", len);
                                 return false;
@@ skipping 34 matching lines @@
                     // Recognize and simplify a very common parametric representation of sRGB gamma.
                     if (color_space_almost_equal(0.9479f, a) &&
                             color_space_almost_equal(0.0521f, b) &&
                             color_space_almost_equal(0.0000f, c) &&
                             color_space_almost_equal(0.0405f, d) &&
                             color_space_almost_equal(0.0774f, e) &&
                             color_space_almost_equal(0.0000f, f) &&
                             color_space_almost_equal(2.4000f, g)) {
                         gammas[i].fValue = 2.2f;
                     } else {
+                        // Fail on invalid gammas.
+                        if (d <= 0.0f) {
+                            // Y = (aX + b)^g + c  for always
+                            if (0.0f == a || 0.0f == g) {
+                                SkColorSpacePrintf("Constant gamma function is nonsense");
+                                return false;
+                            }
+                        } else if (d >= 1.0f) {
+                            // Y = eX + f          for always
+                            if (0.0f == e) {
+                                SkColorSpacePrintf("Constant gamma function is nonsense");

[scroggo, 2016/06/06 17:13:54]

It might help to differentiate these print statements so you can tell which one
it was.

[msarett, 2016/06/06 17:25:05]

Done.

+                                return false;
+                            }
+                        } else if ((0.0f == a || 0.0f == g) && 0.0f == e) {
+                            SkColorSpacePrintf("Constant gamma function is nonsense");
+                            return false;
+                        }
+
                         gammas[i].fG = g;
                         gammas[i].fA = a;
                         gammas[i].fB = b;
                         gammas[i].fC = c;
                         gammas[i].fD = d;
                         gammas[i].fE = e;
                         gammas[i].fF = f;
                     }
                 }
 
                 break;
             }
             default:
                 SkColorSpacePrintf("Unsupported gamma tag type %d\n", type);
                 return false;
         }
 
+        // Ensure that we have successfully read a gamma representation.
+        SkASSERT(gammas[i].isValue() || gammas[i].isTable() || gammas[i].isParametric());
+
         // Adjust src and len if there is another gamma curve to load.
         if (i != numGammas - 1) {
             // Each curve is padded to 4-byte alignment.
             tagBytes = SkAlign4(tagBytes);
             if (len < tagBytes) {
                 return false;
             }
 
             src += tagBytes;
             len -= tagBytes;
@@ skipping 476 matching lines @@
     ptr32[4] = SkEndian_SwapBE32(0x000116cc);
     ptr += kTAG_XYZ_Bytes;
 
     // Write copyright tag
     memcpy(ptr, gEmptyTextTag, sizeof(gEmptyTextTag));
 
     // TODO (msarett): Should we try to hold onto the data so we can return immediately if
     //                 the client calls again?
     return SkData::MakeFromMalloc(profile.release(), kICCProfileSize);
 }