limit the number of points in SkDashPathEffect::asPoints

src/effects/SkDashPathEffect.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkDashPathEffect.h"
 
 #include "SkDashPathPriv.h"
@@ skipping 230 matching lines @@
                     len2 -= clampedInitialDashLength;
                 }
                 len2 -= fIntervals[1];  // also skip first space
                 if (len2 < 0) {
                     len2 = 0;
                 }
             } else {
                 len2 -= clampedInitialDashLength; // skip initial partial empty
             }
         }
-        int numMidPoints = SkScalarFloorToInt(len2 / fIntervalLength);
+        // Too many midpoints can cause results->fNumPoints to overflow or

[reed1, 2016/07/20 18:06:15]

Alternative: we could just return false if the value is too big, since this is
only an optimization routine to draw via points rather than the normal dashing
mechanism...?

+        // otherwise cause the results->fPoints allocation below to OOM.
+        // Cap it to a sane value.
+        static const SkScalar kMaxPoints = 1000000;
+        SkScalar numIntervals = len2 / fIntervalLength;
+        if (!SkScalarIsFinite(numIntervals) || numIntervals > kMaxPoints) {
+            return false;
+        }
+        int numMidPoints = SkScalarFloorToInt(numIntervals);
         results->fNumPoints += numMidPoints;
         len2 -= numMidPoints * fIntervalLength;
         bool partialLast = false;
         if (len2 > 0) {
             if (len2 < fIntervals[0]) {
                 partialLast = true;
             } else {
                 ++numMidPoints;
                 ++results->fNumPoints;
             }
@@ skipping 123 matching lines @@
 #endif
 
 //////////////////////////////////////////////////////////////////////////////////////////////////
 
 sk_sp<SkPathEffect> SkDashPathEffect::Make(const SkScalar intervals[], int count, SkScalar phase) {
     if (!SkDashPath::ValidDashPath(phase, intervals, count)) {
         return nullptr;
     }
     return sk_sp<SkPathEffect>(new SkDashPathEffect(intervals, count, phase));
 }