Prevent integer wrap around for malloc size when creating a SkRegion

src/core/SkRegionPriv.h

 
 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #ifndef SkRegionPriv_DEFINED
@@ skipping 47 matching lines @@
     int getIntervalCount() const {
         return fIntervalCount;
     }
 
     static RunHead* Alloc(int count) {
         //SkDEBUGCODE(sk_atomic_inc(&gRgnAllocCounter);)
         //SkDEBUGF(("************** gRgnAllocCounter::alloc %d\n", gRgnAllocCounter));
 
         SkASSERT(count >= SkRegion::kRectRegionRuns);
 
-        RunHead* head = (RunHead*)sk_malloc_throw(sizeof(RunHead) + count * sizeof(RunType));
+        const int64_t size = sk_64_mul(count, sizeof(RunType)) + sizeof(RunHead);
+        if (count < 0 || !sk_64_isS32(size)) { SK_CRASH(); }
+
+        RunHead* head = (RunHead*)sk_malloc_throw(size);
         head->fRefCnt = 1;
         head->fRunCount = count;
         // these must be filled in later, otherwise we will be invalid
         head->fYSpanCount = 0;
         head->fIntervalCount = 0;
         return head;
     }
 
     static RunHead* Alloc(int count, int yspancount, int intervalCount) {
         SkASSERT(yspancount > 0);
@@ skipping 145 matching lines @@
         bounds->fRight = rite;
         bounds->fBottom = bot;
     }
 
 private:
     int32_t fYSpanCount;
     int32_t fIntervalCount;
 };
 
 #endif