Skia CVE-2019-5755 Buffer Overflow via Incorrect Convexity Assumptions

Critical Vulnerability Information Overview Issue Title: Security: Incorrect convexity assumptions in Skia leading to buffer overflows Status: Fixed Priority: P1 Vulnerability Details CVE ID: 2019-5755 Type: Vulnerability Severity: S1 Description This vulnerability stems from incorrect convexity assumptions in Skia when handling RRect objects, leading to buffer overflows. The detailed description is as follows: 1. Incorrect Assumption: In a related issue (https://bugs.chromium.org/p/chromium/issues/detail?id=850350), due to precision errors, Skia generated a concave RRect but incorrectly declared it as convex. When used as a clip region after an affine transformation, the issue in the concave path caused a heap overflow. 2. Fix: This issue was resolved by correcting the precision error in RRect generation. 3. Remaining Issue: If Skia claims a path is convex, this property is invariant under affine transformations. However, due to precision issues, this assumption can be incorrect in certain cases, potentially leading to small concavities in subsequent processing, which may cause other problems. 4. Example Code and Impact: Example code involving incorrect path ordering and attribute errors is provided, along with how this leads to rendering issues. Recommendations It is recommended to always clear the convexity property during path transformations and to add appropriate checks to prevent memory corruption caused by incorrect convexity assumptions. Reporter and Date Reporter: if...@google.com Created Date: October 29, 2018 Other Participants Assignee: re...@google.com Watchers: Includes multiple individuals such as aw...@google.com, among others involved in Skia development and maintenance.

Goal Reached Thanks to every supporter — we hit 100%!

Skia CVE-2019-5755 Buffer Overflow via Incorrect Convexity Assumptions