Fix integer over flow issue in HTMLCanvasElement::canCreateImageBuffer

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 7c83d770df66171f3e4325b38a98605a2f7ad023..544b44bc0982249467386ea52996b17aed458419 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -122,7 +122,9 @@ bool canCreateImageBuffer(const IntSize& size)
 {
     if (size.isEmpty())
         return false;
-    if (size.width() * size.height() > MaxCanvasArea)
+    CheckedNumeric<int> area = size.width();
+    area *= size.height();
+    if (!area.IsValid() || area.ValueOrDie() > MaxCanvasArea)
         return false;
     if (size.width() > MaxSkiaDim || size.height() > MaxSkiaDim)
         return false;