Prevent integer wrap around for malloc size when creating a SkRegion

src/core/SkRegionPriv.h

Index: src/core/SkRegionPriv.h
diff --git a/src/core/SkRegionPriv.h b/src/core/SkRegionPriv.h
index c8f000df35e6eeb0c7b98b04adf9f29d2294532e..00feedeab80587fe00ae6c208020bf62937c2b11 100644
--- a/src/core/SkRegionPriv.h
+++ b/src/core/SkRegionPriv.h
@@ -65,7 +65,10 @@ public:
 
         SkASSERT(count >= SkRegion::kRectRegionRuns);
 
-        RunHead* head = (RunHead*)sk_malloc_throw(sizeof(RunHead) + count * sizeof(RunType));
+        const int64_t size = sk_64_mul(count, sizeof(RunType)) + sizeof(RunHead);
+        if (count < 0 || !sk_64_isS32(size)) { SK_CRASH(); }
+
+        RunHead* head = (RunHead*)sk_malloc_throw(size);
         head->fRefCnt = 1;
         head->fRunCount = count;
         // these must be filled in later, otherwise we will be invalid