CVE-2019-5785

CVE-2019-5785: An integer overflow in Skia led to potential arbitrary code execution via a crafted HTML page. Affected products include Google Chrome (Skia) prior to 72.0.3626.81 and Mozilla components used by Thunderbird/Firefox (e.g., Skia in Thunderbird before 60.5.1). Mitigation: patch Chrome...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with an affine transform and used as a clipping region for drawing...