Fix integer over flow issue in HTMLCanvasElement::canCreateImageBuffer

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 104 matching lines @@
 // misinterpreted as a user-input value
 const int UndefinedQualityValue = -1.0;
 
 // Default image mime type for toDataURL and toBlob functions
 const char DefaultMimeType[] = "image/png";
 
 bool canCreateImageBuffer(const IntSize& size)
 {
     if (size.isEmpty())
         return false;
-    if (size.width() * size.height() > MaxCanvasArea)
+    CheckedNumeric<int> area = size.width();
+    area *= size.height();
+    if (!area.IsValid() || area.ValueOrDie() > MaxCanvasArea)
         return false;
     if (size.width() > MaxSkiaDim || size.height() > MaxSkiaDim)
         return false;
     return true;
 }
 
 PassRefPtr<Image> createTransparentImage(const IntSize& size)
 {
     DCHECK(canCreateImageBuffer(size));
     sk_sp<SkSurface> surface = SkSurface::MakeRasterN32Premul(size.width(), size.height());
@@ skipping 1088 matching lines @@
 
 bool HTMLCanvasElement::createSurfaceLayer()
 {
     DCHECK(!m_surfaceLayerBridge);
     std::unique_ptr<CanvasSurfaceLayerBridgeClient> bridgeClient = wrapUnique(new CanvasSurfaceLayerBridgeClientImpl());
     m_surfaceLayerBridge = wrapUnique(new CanvasSurfaceLayerBridge(std::move(bridgeClient)));
     return m_surfaceLayerBridge->createSurfaceLayer(this->width(), this->height());
 }
 
 } // namespace blink