Merge 167882 - Security fix: integer overflow on checking image size

webkit/plugins/ppapi/ppb_image_data_impl.cc

Index: webkit/plugins/ppapi/ppb_image_data_impl.cc
===================================================================
--- webkit/plugins/ppapi/ppb_image_data_impl.cc	(revision 170569)
+++ webkit/plugins/ppapi/ppb_image_data_impl.cc	(working copy)
@@ -54,8 +54,8 @@
     return false;  // Only support this one format for now.
   if (width <= 0 || height <= 0)
     return false;
-  if (static_cast<int64>(width) * static_cast<int64>(height) * 4 >=
-      std::numeric_limits<int32>::max())
+  if (static_cast<int64>(width) * static_cast<int64>(height) >=
+      std::numeric_limits<int32>::max() / 4)
     return false;  // Prevent overflow of signed 32-bit ints.
 
   format_ = format;
@@ -285,4 +285,3 @@
 
 }  // namespace ppapi
 }  // namespace webkit
-