Index: Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp |
=================================================================== |
--- Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp (revision 78228) |
+++ Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp (working copy) |
@@ -394,6 +394,9 @@ |
int width = (size.width() + m_tileSize.width() - 1) / m_tileSize.width(); |
int height = (size.height() + m_tileSize.height() - 1) / m_tileSize.height(); |
+ if (height && (width > INT_MAX / height)) |
+ CRASH(); |
+ |
Vector<OwnPtr<Tile> > newTiles; |
newTiles.resize(width * height); |
for (int j = 0; j < m_layerTileSize.height(); ++j) |