add hard-coded limit for tmp allocations when HQ image scaling

src/core/SkConvolver.cpp

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "SkConvolver.h"
+#include "SkMath.h"
 #include "SkSize.h"
 #include "SkTypes.h"
 
 namespace {
 
     // Converts the argument to an 8-bit unsigned value by clamping to the range
     // 0-255.
     inline unsigned char ClampTo8(int a) {
         if (static_cast<unsigned>(a) < 256) {
             return a;  // Avoid the extra check in the common case.
@@ skipping 335 matching lines @@
     *filterOffset = filter.fOffset;
     *filterLength = filter.fTrimmedLength;
     *specifiedFilterlength = filter.fLength;
     if (filter.fTrimmedLength == 0) {
         return nullptr;
     }
 
     return &fFilterValues[filter.fDataLocation];
 }
 
-void BGRAConvolve2D(const unsigned char* sourceData,
+bool BGRAConvolve2D(const unsigned char* sourceData,
                     int sourceByteRowStride,
                     bool sourceHasAlpha,
                     const SkConvolutionFilter1D& filterX,
                     const SkConvolutionFilter1D& filterY,
                     int outputByteRowStride,
                     unsigned char* output,
                     const SkConvolutionProcs& convolveProcs,
                     bool useSimdIfPossible) {
 
     int maxYFilterSize = filterY.maxFilter();
@@ skipping 14 matching lines @@
     // are available. This prevents us from having to store the entire
     // intermediate image and helps cache coherency.
     // We will need four extra rows to allow horizontal convolution could be done
     // simultaneously. We also pad each row in row buffer to be aligned-up to
     // 16 bytes.
     // TODO(jiesun): We do not use aligned load from row buffer in vertical
     // convolution pass yet. Somehow Windows does not like it.
     int rowBufferWidth = (filterX.numValues() + 15) & ~0xF;
     int rowBufferHeight = maxYFilterSize +
                           (convolveProcs.fConvolve4RowsHorizontally ? 4 : 0);
+
+    // check for too-big allocation requests : crbug.com/528628
+    {
+        int64_t size = sk_64_mul(rowBufferWidth, rowBufferHeight);
+        // need some limit, to avoid over-committing success from malloc, but then
+        // crashing when we try to actually use the memory.
+        // 100meg seems big enough to allow "normal" zoom factors and image sizes through
+        // while avoiding the crash seen by the bug (crbug.com/528628)
+        if (size > 100 * 1024 * 1024) {
+//            SkDebugf("BGRAConvolve2D: tmp allocation [%lld] too big\n", size);
+            return false;
+        }
+    }
+
     CircularRowBuffer rowBuffer(rowBufferWidth,
                                 rowBufferHeight,
                                 filterOffset);
 
     // Loop over every possible output row, processing just enough horizontal
     // convolutions to run each subsequent vertical convolution.
     SkASSERT(outputByteRowStride >= filterX.numValues() * 4);
     int numOutputRows = filterY.numValues();
 
     // We need to check which is the last line to convolve before we advance 4
@@ skipping 73 matching lines @@
                                                firstRowForFilter,
                                                filterX.numValues(), curOutputRow,
                                                sourceHasAlpha);
         } else {
             ConvolveVertically(filterValues, filterLength,
                                firstRowForFilter,
                                filterX.numValues(), curOutputRow,
                                sourceHasAlpha);
         }
     }
+    return true;
 }