Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/html/ImageData.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 18 matching lines @@
 #include "config.h"
 #include "core/html/ImageData.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8Uint8ClampedArray.h"
 #include "core/dom/ExceptionCode.h"
 #include "platform/RuntimeEnabledFeatures.h"
 
 namespace blink {
 
-ImageData* ImageData::create(const IntSize& size)
+ImageData* ImageData::create(const IntSize& size, ExceptionState& exceptionState)
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
-    if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0)
+    if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0) {
+        exceptionState.throwDOMException(IndexSizeError, "The requested image size exceeds the supported range.");
         return nullptr;
+    }
 
     RefPtr<DOMUint8ClampedArray> byteArray =
         DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
-    if (!byteArray)
+    if (!byteArray) {
+        exceptionState.throwRangeError("ImageData object creation failed due to insufficient available memory.");
         return nullptr;
+    }
 
     return new ImageData(size, byteArray.release());
 }
 
 ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArray> byteArray)
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
-    if (dataSize.hasOverflowed())
+    if (dataSize.hasOverflowed()
+        || dataSize.unsafeGet() < 0
+        || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length()) {
         return nullptr;
-
-    if (dataSize.unsafeGet() < 0
-        || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length())
-        return nullptr;
+    }
 
     return new ImageData(size, byteArray);
 }
 
 ImageData* ImageData::create(unsigned width, unsigned height, ExceptionState& exceptionState)
 {
     if (!width || !height) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is zero or not a number.", width ? "height" : "width"));
         return nullptr;
     }
 
     Checked<unsigned, RecordOverflow> dataSize = 4;
     dataSize *= width;
     dataSize *= height;
     if (dataSize.hasOverflowed()
         || static_cast<int>(width) < 0
         || static_cast<int>(height) < 0) {
         exceptionState.throwDOMException(IndexSizeError, "The requested image size exceeds the supported range.");
         return nullptr;
     }
 
     RefPtr<DOMUint8ClampedArray> byteArray =
         DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
     if (!byteArray) {
-        exceptionState.throwDOMException(V8GeneralError, "Out of memory at ImageData creation");
+        exceptionState.throwRangeError("ImageData object creation failed due to insufficient available memory.");
         return nullptr;
     }
 
     return new ImageData(IntSize(width, height), byteArray.release());
 }
 
 bool ImageData::validateConstructorArguments(DOMUint8ClampedArray* data, unsigned width, unsigned& lengthInPixels, ExceptionState& exceptionState)
 {
     if (!width) {
         exceptionState.throwDOMException(IndexSizeError, "The source width is zero or not a number.");
@@ skipping 66 matching lines @@
 {
     ASSERT_WITH_SECURITY_IMPLICATION(static_cast<unsigned>(size.width() * size.height() * 4) <= m_data->length());
 }
 
 void ImageData::dispose()
 {
     m_data.clear();
 }
 
 } // namespace blink