Merge 87439

Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp

 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 150 matching lines @@
                                           lookUpTable[SkColorGetG(color)],
                                           lookUpTable[SkColorGetB(color)]);
         }
     }
 }
 
 template <Multiply multiplied>
 PassRefPtr<ByteArray> getImageData(const IntRect& rect, SkDevice& srcDevice,
                                    const IntSize& size)
 {
+    float area = 4.0f * rect.width() * rect.height();
+    if (area > static_cast<float>(std::numeric_limits<int>::max()))
+        return 0;
+
     RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
 
     SkBitmap::Config srcConfig = srcDevice.accessBitmap(false).config();
 
     if (srcConfig == SkBitmap::kNo_Config) {
         // This is an empty SkBitmap that could not be configured.
         ASSERT(!size.width() || !size.height());
         return result.release();
     }
 
@@ skipping 204 matching lines @@
 
     return ImageToDataURL(bitmap, mimeType, quality);
 }
 
 String ImageDataToDataURL(const ImageData& source, const String& mimeType, const double* quality)
 {
     return ImageToDataURL(source, mimeType, quality);
 }
 
 } // namespace WebCore