[libfuzzer] Add a sanity check for too big images in libpng_read_fuzzer.

testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 52 matching lines @@
   buf_state->data = data + kPngHeaderSize;
   buf_state->bytes_left = size - kPngHeaderSize;
   png_set_read_fn(png_ptr, buf_state.get(), user_read_data);
   png_set_sig_bytes(png_ptr, kPngHeaderSize);
 
   // libpng error handling.
   if (setjmp(png_ptr->jmpbuf)) {
     return 0;
   }
 
-  // Reading
+  // Reading.
   png_read_info(png_ptr, info_ptr);
   png_voidp row = png_malloc(png_ptr, png_get_rowbytes(png_ptr, info_ptr));
   base::ScopedClosureRunner png_deleter(base::Bind(
         &png_free, png_ptr, row));
 
   // reset error handler to put png_deleter into scope.
   if (setjmp(png_ptr->jmpbuf)) {
     return 0;
   }
 
   png_uint_32 width, height;
   int bit_depth, color_type, interlace_type, compression_type;
   int filter_type;
 
   if (!png_get_IHDR(png_ptr, info_ptr, &width, &height,
         &bit_depth, &color_type, &interlace_type,
         &compression_type, &filter_type)) {
     return 0;
   }
 
+  // This is going to be too slow.
+  if (height * width > 100000000)

[krasin, 2016/03/17 17:02:48]

what if height * width overflow?

+    return 0;
+
   int passes = png_set_interlace_handling(png_ptr);
   png_start_read_image(png_ptr);
 
   for (int pass = 0; pass < passes; ++pass) {
     for (png_uint_32 y = 0; y < height; ++y) {
       png_read_row(png_ptr, static_cast<png_bytep>(row), NULL);
     }
   }
 
   return 0;
 }