Chrome · Skia
CVE-2026-17992
Uninitialized Memory in Skia
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifsrc/core/SkPathBuilder.cpp |
modified | |
DEF_TESTtests/PathBuilderTest.cpp |
modified |
Files Changed
include/core/SkPathBuilder.hsrc/core/SkPathBuilder.cpptests/PathBuilderTest.cpp
Patch
From da379fdf722dc5df60caefed012952117a5ce4b4 Mon Sep 17 00:00:00 2001
From: Kaylee Lubick <kjlubick@google.com>
Date: Tue, 16 Jun 2026 16:59:17 -0400
Subject: [PATCH] Handle w<=0 conics
SkPath had special logic for degenerate conics [1] and SkGeometry
has an assumption of positive weights [2][3] (possibly other places
too), so this restores that logic to turn it into a lineTo.
[1] https://github.com/google/skia/blob/19936eb1b23fef5187b07fb2e0e67dcf605c0672/src/core/SkPath.cpp#L754-L756
[2] https://github.com/google/skia/blob/d7196b0b493925df3be1e259f41a3c6678732b45/src/core/SkGeometry.h#L350
[3] https://review.skia.org/667436
[4] https://review.skia.org/1225597
Bug: 520506316
Change-Id: I6946e755c5cacade8a487bc882ba0ce5e34531a1
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1267718
Auto-Submit: Kaylee Lubick <kjlubick@google.com>
Commit-Queue: Florin Malita <fmalita@google.com>
Reviewed-by: Florin Malita <fmalita@google.com>
---
diff --git a/include/core/SkPathBuilder.h b/include/core/SkPathBuilder.h
index d4b1907..ad6882d 100644
--- a/include/core/SkPathBuilder.h
+++ b/include/core/SkPathBuilder.h
@@ -252,12 +252,14 @@
Appends kMove_Verb to verb array and (0, 0) to SkPoint array, if needed.
- If w is finite and not one, appends kConic_Verb to verb array;
+ If w is finite, positive, and not one, appends kConic_Verb to verb array;
and pt1, pt2 to SkPoint array; and w to conic weights.
If w is one, appends kQuad_Verb to verb array, and
pt1, pt2 to SkPoint array.
+ If w is zero, this is the same as lineTo(pt2)
+
If w is not finite, appends kLine_Verb twice to verb array, and
pt1, pt2 to SkPoint array.
diff --git a/src/core/SkPathBuilder.cpp b/src/core/SkPathBuilder.cpp
index 76d418a..833763d 100644
--- a/src/core/SkPathBuilder.cpp
+++ b/src/core/SkPathBuilder.cpp
@@ -202,6 +202,9 @@
SkPathBuilder& SkPathBuilder::conicTo(SkPoint pt1, SkPoint pt2, SkScalar w) {
this->ensureMove();
+ if (w <= 0) {
+ return this->lineTo(pt2);
+ }
SkPoint* p = fPts.push_back_n(2);
p[0] = pt1;
p[1] = pt2;
diff --git a/tests/PathBuilderTest.cpp b/tests/PathBuilderTest.cpp
index ba22ad3..b152e8d 100644
--- a/tests/PathBuilderTest.cpp
+++ b/tests/PathBuilderTest.cpp
@@ -7,6 +7,7 @@
#include "include/core/SkPath.h"
#include "include/core/SkPathBuilder.h"
+#include "include/core/SkPathMeasure.h"
#include "include/core/SkPathTypes.h"
#include "include/core/SkPoint.h"
#include "include/core/SkRRect.h"
@@ -1098,11 +1099,73 @@
{
// If w is not finite, appends kLine_Verb twice to verb array, and
// pt1, pt2 to SkPoint array.
- SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, SK_ScalarInfinity).detach();
+ SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, SK_FloatInfinity).detach();
REPORTER_ASSERT(reporter, !p.isEmpty());
REPORTER_ASSERT(reporter, p.verbs().size() == 3u); // moveTo, lineTo, lineTo
REPORTER_ASSERT(reporter, p.points().size() == 3u);
REPORTER_ASSERT(reporter, p.conicWeights().empty());
REPORTER_ASSERT(reporter, p.getSegmentMasks() == SkPath::kLine_SegmentMask);
}
+
+ {
+ // If w is 0, appends kLine_Verb once to verb array, and
+ // pt2 to SkPoint array.
+ SkPath p = SkPathBuilder().conicTo({10, 5}, {10, 10}, 0).detach();
+ REPORTER_ASSERT(reporter, !p.isEmpty());
+ REPORTER_ASSERT(reporter, p.verbs().size() == 2u); // moveTo, lineTo
+ REPORTER_ASSERT(reporter, p.points().size() == 2u);
+ REPORTER_ASSERT(reporter, p.conicWeights().empty());
+ REPORTER_ASSERT(reporter, p.getSegmentMasks() == SkPath::kLine_SegmentMask);
+ }
+}
+
+DEF_TEST(SkPathBuilder_b520944501, reporter) {
+ SkPath path = SkPathBuilder(SkPathFillType::kInverseEvenOdd)
+ .moveTo(0, 0)
+ .cubicTo(8.51330895e-18f,
+ 4.80215861e+30f,
+ 4.80215347e+30f,
+ 4.73888368e-38f,
+ 2.36942783e-38f,
+ 7.54830852e-30f)
+ .moveTo(4.80215831e+30f, 1.03969141e-21f)
+ .conicTo(4.80215831e+30f,
+ 4.73888368e-38f,
+ 2.40107915e+30f,
+ 4.73888368e-38f,
+ 0.707106769f)
+ .conicTo(2.0779294e-21f,
+ 4.73888368e-38f,
+ 2.0779294e-21f,
+ 1.03969141e-21f,
+ 0.707106769f)
+ .conicTo(2.0779294e-21f,
+ 2.07938282e-21f,
+ 2.40107915e+30f,
+ 2.07938282e-21f,
+ 0.707106769f)
+ .conicTo(4.80215831e+30f,
+ 2.07938282e-21f,
+ 4.80215831e+30f,
+ 1.03969141e-21f,
+ 0.707106769f)
+ .close()
+ .detach();
+
+ SkMatrix m;
+ m.setAll(0.0f,
+ 0.0f,
+ 0.0f,
+ 0.0f,
+ 0.0f,
+ 10159839284371128320.0f,
+ 36261335138304000.0f,
+ 0.0f,
+ -0.0f);
+
+ // This previously caused an issue where one of the conic weights turned to
+ // 0, causing an assert later. We should be avoiding that.
+ SkPath transformed = path.makeTransform(m);
+ SkPathMeasure meas(transformed, false);
+ (void)meas.getLength();
}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page