diff --git a/src/gpu/graphite/PipelineData.h b/src/gpu/graphite/PipelineData.h index 236a3f177d2..ec37c938f66 100644 --- a/src/gpu/graphite/PipelineData.h +++ b/src/gpu/graphite/PipelineData.h @@ -16,6 +16,7 @@ #include "include/core/SkTileMode.h" #include "include/private/base/SkTDArray.h" #include "src/base/SkArenaAlloc.h" +#include "src/base/SkSafeMath.h" #include "src/core/SkColorData.h" #include "src/core/SkTHash.h" #include "src/gpu/graphite/BufferManager.h" @@ -479,7 +480,13 @@ public: if (existingOffset) { return {nullptr, *existingOffset}; } - auto [ptr, offset] = this->allocateFloatData(numStops * 5); // 4 for color, 1 for offset + SkSafeMath safe; + int floatCount = safe.mulInt(numStops, 5); // 4 for color, 1 for offset + safe.addInt(fGradientStorage.size(), floatCount); + if (!safe.ok()) { + return {nullptr, 0}; + } + auto [ptr, offset] = this->allocateFloatData(floatCount); fGradientOffsetCache.set(shader->uniqueID(), offset); return {ptr, offset};