Browse Source

chore: cherry-pick 6763a713f957 from skia (#26957)

Michaela Laurencin 4 years ago
parent
commit
2d1da97f47
2 changed files with 32 additions and 0 deletions
  1. 1 0
      patches/skia/.patches
  2. 31 0
      patches/skia/cherry-pick-6763a713f957.patch

+ 1 - 0
patches/skia/.patches

@@ -1,2 +1,3 @@
 backport_1080481.patch
 mallocpixelref_should_always_allocate_as_large_as_computebytesize.patch
+cherry-pick-6763a713f957.patch

+ 31 - 0
patches/skia/cherry-pick-6763a713f957.patch

@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Brian Osman <[email protected]>
+Date: Thu, 3 Sep 2020 15:19:14 -0400
+Subject: Limit morphology radius to 100 pixels
+
+This limit is arbitrary, but hopefully prevents pathological (or
+malicious) SVG content from consuming huge amounts of CPU/GPU time,
+without impacting any legitimate uses of feMorphology. (Typical usage
+has a much smaller radius).
+
+Bug: chromium:1123035
+Change-Id: I4405bc595128e9a6287eb5efa1be14621baa3a00
+Reviewed-on: https://skia-review.googlesource.com/c/skia/+/315219
+Reviewed-by: Mike Reed <[email protected]>
+Commit-Queue: Brian Osman <[email protected]>
+
+diff --git a/src/effects/imagefilters/SkMorphologyImageFilter.cpp b/src/effects/imagefilters/SkMorphologyImageFilter.cpp
+index a4b970e565d1feee363c77eff59c0cee5f15fef0..9b488e802d7544b449e20b49661b78b08c2ee62e 100644
+--- a/src/effects/imagefilters/SkMorphologyImageFilter.cpp
++++ b/src/effects/imagefilters/SkMorphologyImageFilter.cpp
+@@ -744,7 +744,9 @@ sk_sp<SkSpecialImage> SkMorphologyImageFilterImpl::onFilterImage(const Context&
+     int height = SkScalarFloorToInt(radius.height());
+ 
+     // Width (or height) must fit in a signed 32-bit int to avoid UBSAN issues (crbug.com/1018190)
+-    constexpr int kMaxRadius = (std::numeric_limits<int>::max() - 1) / 2;
++    // Further, we limit the radius to something much smaller, to avoid extremely slow draw calls:
++    // (crbug.com/1123035):
++    constexpr int kMaxRadius = 100; // (std::numeric_limits<int>::max() - 1) / 2;
+ 
+     if (width < 0 || height < 0 || width > kMaxRadius || height > kMaxRadius) {
+         return nullptr;