Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/CSSSelector.cpp

 /*
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  *               2001 Andreas Schlapbach (schlpbch@iam.unibe.ch)
  *               2001-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 915 matching lines @@
 }
 
 // a helper function for checking nth-arguments
 bool CSSSelector::RareData::matchNth(int count)
 {
     if (!nthAValue())
         return count == nthBValue();
     if (nthAValue() > 0) {
         if (count < nthBValue())
             return false;
+        // Avoid overflow and underflow.
+        if (UNLIKELY((nthBValue() > 0 && count < std::numeric_limits<int>::min() + nthBValue())
+            || (nthBValue() < 0 && count > std::numeric_limits<int>::max() + nthBValue())))
+            return false;
         return (count - nthBValue()) % nthAValue() == 0;
     }
     if (count > nthBValue())
         return false;
+    int minInt = std::numeric_limits<int>::min();
+    // Avoid negating minimum int as it negates to itself.
+    if (UNLIKELY(nthAValue() == minInt || count == minInt))

[esprehn, 2016/08/15 16:19:23]

how can count be minInt? count is the index of the element, I think it has to be
a positive value. I'm actually not sure why we use int instead of unsigned?

+        return false;
+    // Avoid overflow and underflow.
+    if ((UNLIKELY(count > 0 && nthBValue() < std::numeric_limits<int>::min() + count)
+        || (count < 0 && nthBValue() > std::numeric_limits<int>::max() + count)))
+        return false;
     return (nthBValue() - count) % (-nthAValue()) == 0;
 }
 
 } // namespace blink