Prevent integer overflow in ComputedStyle::outlineOutsetExtent.

third_party/WebKit/Source/core/style/ComputedStyle.cpp

 /*
  * Copyright (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 34 matching lines @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/fonts/Font.h"
 #include "platform/fonts/FontSelector.h"
 #include "platform/geometry/FloatRoundedRect.h"
 #include "platform/graphics/GraphicsContext.h"
 #include "platform/transforms/RotateTransformOperation.h"
 #include "platform/transforms/ScaleTransformOperation.h"
 #include "platform/transforms/TranslateTransformOperation.h"
 #include "wtf/MathExtras.h"
 #include "wtf/PtrUtil.h"
+#include "wtf/SaturatedArithmetic.h"
 #include <algorithm>
 #include <memory>
 
 namespace blink {
 
 struct SameSizeAsBorderValue {
     RGBA32 m_color;
     unsigned m_width;
 };
 
@@ skipping 1712 matching lines @@
 {
     m_rareNonInheritedData.access()->m_transform.access()->m_motion.m_path = path;
 }
 
 int ComputedStyle::outlineOutsetExtent() const
 {
     if (!hasOutline())
         return 0;
     if (outlineStyleIsAuto())
         return GraphicsContext::focusRingOutsetExtent(outlineOffset(), outlineWidth());
-    return std::max(0, outlineWidth() + outlineOffset());
+    return std::max(0, saturatedAddition(outlineWidth(), outlineOffset()));
 }
 
 bool ComputedStyle::columnRuleEquivalent(const ComputedStyle* otherStyle) const
 {
     return columnRuleStyle() == otherStyle->columnRuleStyle()
         && columnRuleWidth() == otherStyle->columnRuleWidth()
         && visitedDependentColor(CSSPropertyColumnRuleColor) == otherStyle->visitedDependentColor(CSSPropertyColumnRuleColor);
 }
 
 TextEmphasisMark ComputedStyle::getTextEmphasisMark() const
@@ skipping 160 matching lines @@
         if (value < 0)
             fvalue -= 0.5f;
         else
             fvalue += 0.5f;
     }
 
     return roundForImpreciseConversion<int>(fvalue / zoomFactor);
 }
 
 } // namespace blink