Skip to content

[skia] Guard against overflow in blur code - #4968

Merged
dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:OSV-2022-576
Mar 13, 2025
Merged

dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:OSV-2022-576

Conversation

@dahlstrom-g

Copy link
Copy Markdown
Contributor

Fixed: 398591179

dahlstrom-g added a commit to dahlstrom-g/cobalt that referenced this pull request Feb 25, 2025
Fixed: 398591179
Reviewed-on: youtube#4968
@youtube youtube deleted a comment from google-cla Bot Feb 25, 2025
@kaidokert kaidokert changed the title Guard against overflow in blur code [skia] Guard against overflow in blur code Mar 5, 2025
herbderby and others added 2 commits March 13, 2025 10:00
This fuzz creates a blur that has w = 1 and h = 2^31 - epsilon.
And a filter sigma of 360. This causes the intermediate
buffer size > 2^31. This causes the multiply in the following
code SkMaskBlurFilter.cpp:1023:

  tmpStart + tmpW * tmpH

to overflow. Because tmpW = source height, which is near 2^31,
and tmpH is about 3*360.

Cause the blur to fail if the intermediate buffer is > INT_MAX.

(cherry picked from commit b70a030066b554b0fc7ba4c061449ac486a62283)

Reviewed-on: https://skia-review.googlesource.com/c/skia/+/558305
… by commit 1da0fc5.

Issue: 398591179
Reviewed-on: youtube#4968
@dahlstrom-g
dahlstrom-g merged commit 744299c into youtube:25.lts.1+ Mar 13, 2025
@dahlstrom-g
dahlstrom-g deleted the OSV-2022-576 branch March 13, 2025 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants