diff --git a/third_party/skia/src/shaders/SkShaderBase.cpp b/third_party/skia/src/shaders/SkShaderBase.cpp index 5d20ba49ea1..dcbf19238c1 100644 --- a/third_party/skia/src/shaders/SkShaderBase.cpp +++ b/third_party/skia/src/shaders/SkShaderBase.cpp @@ -29,7 +29,12 @@ uint32_t next_unique_id() { static std::atomic gNextUniqueID{SK_InvalidUniqueID + 1}; uint32_t id = SK_InvalidUniqueID; do { - id = gNextUniqueID.fetch_add(1, std::memory_order_relaxed); + // POC TIME-COMPRESSION: mask to 8 bits so the 32-bit counter wrap (which a + // compromised renderer can drive in ~hours by streaming ~2^32 PaintOp gradient + // shaders to the GPU process) is reproducible in seconds. The vulnerable + // de-duplication logic in FloatStorageManager::allocateGradientData() is + // unchanged; only the time-to-wrap is reduced. + id = gNextUniqueID.fetch_add(1, std::memory_order_relaxed) & 0xFFu; } while (id == SK_InvalidUniqueID); return id; }