From f9247c57c7d1eb1fcf40a4c846e6a2065c249189 Mon Sep 17 00:00:00 2001
From: Thomas Smith <thomsmit@google.com>
Date: Wed, 23 Sep 2026 10:24:26 -0400
Subject: [PATCH] [ganesh] Prevent SmallPathAtlas SDF and Bitmap collision

* Very clever draws can cause a collision between SDFs and Bitmaps in
Ganesh's SmallPathAtlas, leading to a potential data leak.

* This patch adds a data tag to the SmallPath entries, which precludes
collisions.

Bug: b/553126587
Change-Id: I2fcca20ff9d61a4b63f54ee66ce53896b9ef5736
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1369157
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Thomas Smith <thomsmit@google.com>
---
diff --git a/src/gpu/ganesh/ops/SmallPathShapeData.cpp b/src/gpu/ganesh/ops/SmallPathShapeData.cpp
index 28e767d..e6257ad 100644
--- a/src/gpu/ganesh/ops/SmallPathShapeData.cpp
+++ b/src/gpu/ganesh/ops/SmallPathShapeData.cpp
@@ -24,9 +24,10 @@
     SkASSERT(shape.style().isSimpleFill());
     SkASSERT(shape.hasUnstyledKey());
     int shapeKeySize = shape.unstyledKeySize();
-    fKey.reset(1 + shapeKeySize);
-    fKey[0] = dim;
-    shape.writeUnstyledKey(&fKey[1]);
+    fKey.reset(2 + shapeKeySize);
+    fKey[0] = static_cast<uint32_t>(Type::kSDF);
+    fKey[1] = dim;
+    shape.writeUnstyledKey(&fKey[2]);
 }
 
 SmallPathShapeDataKey::SmallPathShapeDataKey(const GrStyledShape& shape, const SkMatrix& ctm) {
@@ -47,13 +48,14 @@
     SkFixed fracX = SkScalarToFixed(tx) & 0x0000FF00;
     SkFixed fracY = SkScalarToFixed(ty) & 0x0000FF00;
     int shapeKeySize = shape.unstyledKeySize();
-    fKey.reset(5 + shapeKeySize);
-    fKey[0] = SkFloat2Bits(sx);
-    fKey[1] = SkFloat2Bits(sy);
-    fKey[2] = SkFloat2Bits(kx);
-    fKey[3] = SkFloat2Bits(ky);
-    fKey[4] = fracX | (fracY >> 8);
-    shape.writeUnstyledKey(&fKey[5]);
+    fKey.reset(6 + shapeKeySize);
+    fKey[0] = static_cast<uint32_t>(Type::kBitmap);
+    fKey[1] = SkFloat2Bits(sx);
+    fKey[2] = SkFloat2Bits(sy);
+    fKey[3] = SkFloat2Bits(kx);
+    fKey[4] = SkFloat2Bits(ky);
+    fKey[5] = fracX | (fracY >> 8);
+    shape.writeUnstyledKey(&fKey[6]);
 }
 
 }  // namespace skgpu::ganesh
diff --git a/src/gpu/ganesh/ops/SmallPathShapeData.h b/src/gpu/ganesh/ops/SmallPathShapeData.h
index 908c5ad..ad5f235 100644
--- a/src/gpu/ganesh/ops/SmallPathShapeData.h
+++ b/src/gpu/ganesh/ops/SmallPathShapeData.h
@@ -40,6 +40,11 @@
 
 class SmallPathShapeDataKey {
 public:
+    enum class Type : uint32_t {
+        kSDF = 0,
+        kBitmap = 1,
+    };
+
     // TODO: add a move variant
     SmallPathShapeDataKey(const SmallPathShapeDataKey& that) {
         fKey.reset(that.fKey.count());
@@ -63,10 +68,10 @@
     const uint32_t* data() const { return fKey.get(); }
 
 private:
-    // The key is composed of the GrStyledShape's key, and either the dimensions of the DF
-    // generated for the path (32x32 max, 64x64 max, 128x128 max) if an SDF image or
-    // the matrix for the path with only fractional translation.
-    skia_private::AutoSTArray<24, uint32_t> fKey;
+    // The key is composed of the domain tag (kSDF or KBitmap), GrStyledShape's key, and either the
+    // dimensions of the DF generated for the path (32x32 max, 64x64 max, 128x128 max) if an SDF
+    // image or the matrix for the path with only fractional translation.
+    skia_private::AutoSTArray<25, uint32_t> fKey;
 };
 
 class SmallPathShapeData {
diff --git a/tests/SmallPathRendererTest.cpp b/tests/SmallPathRendererTest.cpp
index 60d392e..5e74703 100644
--- a/tests/SmallPathRendererTest.cpp
+++ b/tests/SmallPathRendererTest.cpp
@@ -48,3 +48,94 @@
     sdc->drawPath(nullptr, GrPaint(), GrAA::kYes, m, smolpath, style);
     ctx->flushAndSubmit();
 }
+
+#if !defined(SK_ENABLE_OPTIMIZE_SIZE)
+
+#include "src/core/SkFloatBits.h"
+#include "src/gpu/ganesh/geometry/GrStyledShape.h"
+#include "src/gpu/ganesh/ops/SmallPathShapeData.h"
+
+DEF_TEST(SmallPathShapeDataKey_DomainSeparation, reporter) {
+    SkPath path = SkPath::Polygon({{-1, -1}, {1, -1}, {1, 1}, {-1, 1}}, true);
+    GrStyledShape shape(path);
+    skgpu::ganesh::SmallPathShapeDataKey sdfKey(shape, 32);
+    skgpu::ganesh::SmallPathShapeDataKey bmKey(shape, SkMatrix::I());
+
+    REPORTER_ASSERT(reporter, !(sdfKey == bmKey));
+    REPORTER_ASSERT(reporter, sdfKey.data()[0] ==
+            static_cast<uint32_t>(skgpu::ganesh::SmallPathShapeDataKey::Type::kSDF));
+    REPORTER_ASSERT(reporter, bmKey.data()[0] ==
+            static_cast<uint32_t>(skgpu::ganesh::SmallPathShapeDataKey::Type::kBitmap));
+}
+
+DEF_TEST(SmallPathShapeDataKey_CollisionReproduction, reporter) {
+    // 1. Construct Shape B (Bitmap side)
+    const float p0_x = SkBits2Float(0x28);
+    const float p0_y = 0.45f;
+    const float p1_x = 0.2f; // "free"
+    const float p1_y = 0.45f;
+    const float p2_x = 0.49f;
+    const float p2_y = SkBits2Float(0x700000);
+    const float p3_x = 65.0f;
+    const float p3_y = SkBits2Float(0x6);
+    const float p4_x = -1.0f;
+    const float p4_y = 1.5f;
+
+    SkPath pathB = SkPathBuilder()
+        .moveTo(p0_x, p0_y)
+        .lineTo(p1_x, p1_y)
+        .lineTo(p2_x, p2_y)
+        .quadTo(p3_x, p3_y, p4_x, p4_y)
+        .detach();
+    pathB.setFillType(SkPathFillType::kWinding);
+
+    SkMatrix ctmB = SkMatrix::MakeAll(
+        SkBits2Float(162), -1.0f, 0.0f,
+        -1.0f, SkBits2Float(0x10C), 0.0f,
+        0.0f, 0.0f, 1.0f
+    );
+
+    GrStyledShape shapeB(pathB);
+    skgpu::ganesh::SmallPathShapeDataKey keyB(shapeB, ctmB);
+
+    // 2. Construct Shape A (DF side)
+    SkRect rectA = SkRect::MakeLTRB(-1.0f, -1.0f, 0.0f, SkBits2Float(0x110));
+    SkVector radiiA[4] = {
+        { SkBits2Float(4),    SkBits2Float(0x02010100) }, // UL
+        { SkBits2Float(0x28), 0.45f },                    // UR
+        { 0.2f,               0.45f },                    // LR
+        { 0.49f,              SkBits2Float(0x700000)   }  // LL
+    };
+    SkRRect rrectA;
+    rrectA.setRectRadii(rectA, radiiA);
+
+    SkPaint strokePaint;
+    strokePaint.setStyle(SkPaint::kStroke_Style);
+    strokePaint.setStrokeWidth(1.5f);
+    strokePaint.setStrokeJoin(SkPaint::kRound_Join);
+    strokePaint.setStrokeCap(SkPaint::kButt_Cap);
+    GrStyle styleA(strokePaint);
+
+    GrStyledShape parentShapeA(rrectA, styleA);
+    GrStyledShape shapeA = parentShapeA.applyStyle(GrStyle::Apply::kPathEffectAndStrokeRec, 65.0f);
+    skgpu::ganesh::SmallPathShapeDataKey keyA(shapeA, 162);
+
+    // Both keys have identical lengths (19 words: 1 word tag + 18 payload words)
+    REPORTER_ASSERT(reporter, keyA.count32() == 19);
+    REPORTER_ASSERT(reporter, keyB.count32() == 19);
+
+    // Verify the 18 payload words match byte-for-byte!
+    // Without the domain tag, this would have been an exact collision.
+    int payloadDiff = memcmp(&keyA.data()[1], &keyB.data()[1], 18 * sizeof(uint32_t));
+    REPORTER_ASSERT(reporter, payloadDiff == 0);
+
+    // With the domain tag, keyA != keyB:
+    REPORTER_ASSERT(reporter, !(keyA == keyB));
+    REPORTER_ASSERT(reporter, keyA.data()[0] ==
+            static_cast<uint32_t>(skgpu::ganesh::SmallPathShapeDataKey::Type::kSDF));
+    REPORTER_ASSERT(reporter, keyB.data()[0] ==
+            static_cast<uint32_t>(skgpu::ganesh::SmallPathShapeDataKey::Type::kBitmap));
+}
+
+#endif // !defined(SK_ENABLE_OPTIMIZE_SIZE)
+