Chrome · Skia
CVE-2026-17992
Uninitialized Memory in Skia
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifsrc/core/SkPathBuilder.cpp |
modified | |
DEF_TESTtests/PathBuilderTest.cpp |
modified |
Files Changed
include/core/SkPathBuilder.hsrc/core/SkPathBuilder.cpptests/PathBuilderTest.cpp
Patch
From da379fdf722dc5df60caefed012952117a5ce4b4 Mon Sep 17 00:00:00 2001 From: Kaylee Lubick <[email protected]> Date: Tue, 16 Jun 2026 16:59:17 -0400 Subject: [PATCH] Handle w<=0 conics SkPath had special logic for degenerate conics [1] and SkGeometry has an assumption of positive weights [2][3] (possibly other places too), so this restores that logic to turn it into a lineTo. [1] https://github.com/google/skia/blob/19936eb1b23fef5187b07fb2e0e67dcf605c0672/src/core/SkPath.cpp#L754-L756 [2] https://github.com/google/skia/blob/d7196b0b493925df3be1e259f41a3c6678732b45/src/core/SkGeometry.h#L350 [3] https://review.skia.org/667436 [4] https://review.skia.org/1225597 Bug: 520506316 Change-Id: I6946e755c5cacade8a487bc882ba0ce5e34531a1 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1267718 Auto-Submit: Kaylee Lubick <[email protected]> Commit-Queue: Florin Malita <[email protected]> Reviewed-by: Florin Malita <[email protected]> --- diff --git a/include/core/SkPathBuilder.h b/include/core/SkPathBuilder.h index d4b1907..ad6882d 100644 --- a/include/core/SkPathBuilder.h +++ b/include/core/SkPathBuilder.h @@ -252,12 +252,14 @@ Appends kMove_Verb to verb array and (0, 0) to SkPoint array, if needed. - If w is finite and not one, appends kConic_Verb to verb array; + If w is finite, positive, and not one, appends kConic_Verb to verb array; and pt1, pt2 to SkPoint array; and w to conic weights. If w is one, appends kQuad_Verb to verb array, and pt1, pt2 to SkPoint array. + If w is zero, this is the same as lineTo(pt2) + If w is not finite, appends kLine_Verb twice to verb array, and pt1, pt2 to SkPoint array. diff --git a/src/core/SkPathBuilder.cpp b/src/core/SkPathBuilder.cpp index 76d418a..833763d 100644 --- a/src/core/SkPathBuilder.cpp +++ b/src/core/SkPathBuilder.cpp @@ -202,6 +202,9 @@ SkPathBuilder& SkPathBuilder::conicTo(SkPoint pt1, SkPoint pt2, SkScalar w) { this->ensureMove(); + if (w <= 0) { + return this->lineTo(pt2); + } SkPoint* p = fPts.push_back_n(2); p[0] = pt1; p[1] = pt2; diff --git a/tests/PathBuilderTest.cpp b/tests/PathBuilderTest.cpp index ba22ad3..b152e8d 100644 --- a/tests/PathBuilderTest.cpp +++ b/tests/PathBuilderTest.cpp @@ -7,6 +7,7 @@ #include "include/core/SkPath.h" #include "include/core/SkPathBuilder.h" +#include "include/core/SkPathMeasure.h" #include "include/core/SkPathTypes.h" #include "include/core/SkPoint.h" #include "include/core/SkRRect.h" @@ -1098,11 +1099,73 @@ { // If w is not finite, appends kLine_Verb twice to verb array, and // pt1, pt2 to SkPoint array. - SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, SK_ScalarInfinity).detach(); + SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, SK_FloatInfinity).detach(); REPORTER_ASSERT(reporter, !p.isEmpty()); REPORTER_ASSERT(reporter, p.verbs().size() == 3u); // moveTo, lineTo, lineTo REPORTER_ASSERT(reporter, p.points().size() == 3u); REPORTER_ASSERT(reporter, p.conicWeights().empty()); REPORTER_ASSERT(reporter, p.getSegmentMasks() == SkPath::kLine_SegmentMask); } + + { + // If w is 0, appends kLine_Verb once to verb array, and + // pt2 to SkPoint array. + SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, 0).detach(); + REPORTER_ASSERT(reporter, !p.isEmpty()); + REPORTER_ASSERT(reporter, p.verbs().size() == 2u); // moveTo, lineTo + REPORTER_ASSERT(reporter, p.points().size() == 2u); + REPORTER_ASSERT(reporter, p.conicWeights().empty()); + REPORTER_ASSERT(reporter, p.getSegmentMasks() == SkPath::kLine_SegmentMask); + } +} + +DEF_TEST(SkPathBuilder_b520944501, reporter) { + SkPath path = SkPathBuilder(SkPathFillType::kInverseEvenOdd) + .moveTo(0, 0) + .cubicTo(8.51330895e-18f, + 4.80215861e+30f, + 4.80215347e+30f, + 4.73888368e-38f, + 2.36942783e-38f, + 7.54830852e-30f) + .moveTo(4.80215831e+30f, 1.03969141e-21f) + .conicTo(4.80215831e+30f, + 4.73888368e-38f, + 2.40107915e+30f, + 4.73888368e-38f, + 0.707106769f) + .conicTo(2.0779294e-21f, + 4.73888368e-38f, + 2.0779294e-21f, + 1.03969141e-21f, + 0.707106769f) + .conicTo(2.0779294e-21f, + 2.07938282e-21f, + 2.40107915e+30f, + 2.07938282e-21f, + 0.707106769f) + .conicTo(4.80215831e+30f, + 2.07938282e-21f, + 4.80215831e+30f, + 1.03969141e-21f, + 0.707106769f) + .close() + .detach(); + + SkMatrix m; + m.setAll(0.0f, + 0.0f, + 0.0f, + 0.0f, + 0.0f, + 10159839284371128320.0f, + 36261335138304000.0f, + 0.0f, + -0.0f); + + // This previously caused an issue where one of the conic weights turned to + // 0, causing an assert later. We should be avoiding that. + SkPath transformed = path.makeTransform(m); + SkPathMeasure meas(transformed, false); + (void)meas.getLength(); }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page