check for big sizes in NewData

src/core/SkData.cpp

 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkData.h"
 #include "SkLazyPtr.h"
 #include "SkOSFile.h"
@@ skipping 45 matching lines @@
     SkASSERT(length > 0);
 
     memcpy(buffer, this->bytes() + offset, length);
     return length;
 }
 
 SkData* SkData::PrivateNewWithCopy(const void* srcOrNull, size_t length) {
     if (0 == length) {
         return SkData::NewEmpty();
     }
-    char* storage = (char*)sk_malloc_throw(sizeof(SkData) + length);
+
+    const size_t actualLength = length + sizeof(SkData);
+    if (actualLength < length) {
+        // we overflowed
+        sk_throw();
+    }
+
+    char* storage = (char*)sk_malloc_throw(actualLength);
     SkData* data = new (storage) SkData(length);
     if (srcOrNull) {
         memcpy(data->writable_data(), srcOrNull, length);
     }
     return data;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 // As a template argument these must have external linkage.
@@ skipping 106 matching lines @@
 ///////////////////////////////////////////////////////////////////////////////
 
 SkData* SkData::NewFromStream(SkStream* stream, size_t size) {
     SkAutoDataUnref data(SkData::NewUninitialized(size));
     if (stream->read(data->writable_data(), size) != size) {
         return NULL;
     }
     return data.detach();
 }