Fix a overflow in WebCursorn

content/common/cursors/webcursor.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/cursors/webcursor.h"
 
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "third_party/WebKit/public/platform/WebImage.h"
 
@@ skipping 94 matching lines @@
       size_x / scale > kMaxCursorDimension ||
       size_y / scale > kMaxCursorDimension)
     return false;
 
   type_ = type;
 
   if (type == WebCursorInfo::TypeCustom) {
     if (size_x > 0 && size_y > 0) {
       // The * 4 is because the expected format is an array of RGBA pixel
       // values.
-      if (size_x * size_y * 4 > data_len)
+      if (size_x * size_y * 4 != data_len) {
+        LOG(WARNING) << "WebCursor's data length and image size mismatch: "
+                     << size_x << "x" << size_y << "x4 != "
+                     << data_len;
         return false;
+      }
 
       hotspot_.set_x(hotspot_x);
       hotspot_.set_y(hotspot_y);
       custom_size_.set_width(size_x);
       custom_size_.set_height(size_y);
       custom_scale_ = scale;
       ClampHotspot();
 
       custom_data_.clear();
       if (data_len > 0) {
@@ skipping 131 matching lines @@
     return;
 
   // Clamp the hotspot to the custom image's dimensions.
   hotspot_.set_x(std::max(0,
                           std::min(custom_size_.width() - 1, hotspot_.x())));
   hotspot_.set_y(std::max(0,
                           std::min(custom_size_.height() - 1, hotspot_.y())));
 }
 
 }  // namespace content