RazrFalcon / tiny-skia

A tiny Skia subset ported to Rust
BSD 3-Clause "New" or "Revised" License
1.12k stars 69 forks source link

[Fuzzing] Panic : stroke_path hair line (specific path values) #49

Closed Wardenfar closed 2 years ago

Wardenfar commented 2 years ago

The code below panics. Latest version : tiny-skia = "0.6.5"

The panic come from the unwrap at line 811 of src/geom.rs. (Maybe return an option instead ?) The value was found with fuzzing.

I will try a PR to fix it.

use tiny_skia::{Pixmap, PathBuilder, Transform, Stroke, Paint};

fn main() {
    // specific value 
    let x = f32::from_be_bytes([0x64, 0x00, 0x00, 0x00]);

    let mut pixmap = Pixmap::new(512, 512).unwrap();

    let mut builder = PathBuilder::default();
    builder.move_to(338.80466, 545.2891);
    builder.line_to(x, 577.8069);
    builder.line_to(488.0846, 471.04388);
    let path = builder.finish();
    if path.is_none() {
        return;
    }
    let path = path.unwrap();

    let stroke = Stroke {
        width: 0.0,
        ..Default::default()
    };

    pixmap.stroke_path(&path, &Paint::default(), &stroke, Transform::identity(), None);
}