Guard against overflow

linebender · Jun 25, 2021 · b967956 · b967956
1 parent a8c39fa
commit b967956
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 4 deletions.
diff --git a/piet-gpu/shader/kernel4.comp b/piet-gpu/shader/kernel4.comp
@@ -212,8 +212,11 @@ void main() {
             break;
         case Cmd_BeginClip:
             for (uint k = 0; k < CHUNK; k++) {
-                blend_stack[clip_depth][k] = packsRGB(vec4(rgba[k]));
-                blend_alpha_stack[clip_depth][k] = clamp(abs(area[k]), 0.0, 1.0);
+                // We reject any inputs that might overflow in render_ctx.rs.
+                // The following is a sanity check so we don't corrupt memory should there be malformed inputs.
+                uint d = min(clip_depth, MAX_BLEND_STACK - 1);
+                blend_stack[d][k] = packsRGB(vec4(rgba[k]));
+                blend_alpha_stack[d][k] = clamp(abs(area[k]), 0.0, 1.0);
                 rgba[k] = vec4(0.0);
             }
             clip_depth++;
@@ -222,8 +225,9 @@ void main() {
         case Cmd_EndClip:
             clip_depth--;
             for (uint k = 0; k < CHUNK; k++) {
-                mediump vec4 bg = unpacksRGB(blend_stack[clip_depth][k]);
-                mediump vec4 fg = rgba[k] * area[k] * blend_alpha_stack[clip_depth][k];
+                uint d = min(clip_depth, MAX_BLEND_STACK - 1);
+                mediump vec4 bg = unpacksRGB(blend_stack[d][k]);
+                mediump vec4 fg = rgba[k] * area[k] * blend_alpha_stack[d][k];
                 rgba[k] = bg * (1.0 - fg.a) + fg;
             }
             cmd_ref.offset += 4;

diff --git a/piet-gpu/shader/kernel4.spv b/piet-gpu/shader/kernel4.spv
diff --git a/piet-gpu/shader/kernel4_idx.spv b/piet-gpu/shader/kernel4_idx.spv
diff --git a/piet-gpu/src/lib.rs b/piet-gpu/src/lib.rs
@@ -30,6 +30,8 @@ const WIDTH_IN_TILES: usize = 128;
 const HEIGHT_IN_TILES: usize = 96;
 const PTCL_INITIAL_ALLOC: usize = 1024;
 
+const MAX_BLEND_STACK: usize = 128;
+
 const N_CIRCLES: usize = 0;
 
 pub fn render_svg(rc: &mut impl RenderContext, filename: &str, scale: f64) {

diff --git a/piet-gpu/src/render_ctx.rs b/piet-gpu/src/render_ctx.rs
@@ -8,6 +8,7 @@ use piet::{
     Color, Error, FixedGradient, FontFamily, HitTestPoint, ImageFormat, InterpolationMode,
     IntoBrush, LineMetric, RenderContext, StrokeStyle, Text, TextLayout, TextLayoutBuilder,
 };
+use crate::MAX_BLEND_STACK;
 
 use piet_gpu_types::encoder::{Encode, Encoder};
 use piet_gpu_types::scene::{
@@ -211,6 +212,9 @@ impl RenderContext for PietGpuRenderContext {
         self.elements.push(Element::BeginClip(Clip {
             bbox: Default::default(),
         }));
+        if self.clip_stack.len() >= MAX_BLEND_STACK {
+            panic!("Maximum clip/blend stack size {} exceeded", MAX_BLEND_STACK);
+        }
         self.clip_stack.push(ClipElement {
             bbox: None,
             begin_ix,