Avoid integer overflow in WheelEvent constructor

third_party/WebKit/Source/core/events/WheelEvent.cpp

 /*
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2003, 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 16 matching lines @@
 #include "platform/PlatformMouseEvent.h"
 #include "platform/PlatformWheelEvent.h"
 
 namespace blink {
 
 inline static unsigned convertDeltaMode(const PlatformWheelEvent& event)
 {
     return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::kDomDeltaPage : WheelEvent::kDomDeltaPixel;
 }
 
+// Negate a long value without integer overflow.
+inline static long negateIfPossible(long value)
+{
+    if (value == LONG_MIN)
+        return value;
+    return -value;
+}
+
 WheelEvent* WheelEvent::create(const PlatformWheelEvent& event, AbstractView* view)
 {
     return new WheelEvent(FloatPoint(event.wheelTicksX(), event.wheelTicksY()), FloatPoint(event.deltaX(), event.deltaY()),
         convertDeltaMode(event), view, event.globalPosition(), event.position(),
         event.getModifiers(),
         MouseEvent::platformModifiersToButtons(event.getModifiers()), event.timestamp(),
         event.resendingPluginId(), event.hasPreciseScrollingDeltas(),
         static_cast<Event::RailsMode>(event.getRailsMode()),
         event.cancelable()
 #if OS(MACOSX)
         , static_cast<WheelEventPhase>(event.phase()), static_cast<WheelEventPhase>(event.momentumPhase())
 #endif
         );
 }
 
 WheelEvent::WheelEvent()
     : m_deltaX(0)
     , m_deltaY(0)
     , m_deltaZ(0)
     , m_deltaMode(kDomDeltaPixel)
     , m_resendingPluginId(-1)
     , m_hasPreciseScrollingDeltas(false)
     , m_railsMode(RailsModeFree)
 {
 }
 
 WheelEvent::WheelEvent(const AtomicString& type, const WheelEventInit& initializer)
     : MouseEvent(type, initializer)
     , m_wheelDelta(initializer.wheelDeltaX() ? initializer.wheelDeltaX() : -initializer.deltaX(), initializer.wheelDeltaY() ? initializer.wheelDeltaY() : -initializer.deltaY())
-    , m_deltaX(initializer.deltaX() ? initializer.deltaX() : -initializer.wheelDeltaX())
-    , m_deltaY(initializer.deltaY() ? initializer.deltaY() : -initializer.wheelDeltaY())
+    , m_deltaX(initializer.deltaX() ? initializer.deltaX() : negateIfPossible(initializer.wheelDeltaX()))
+    , m_deltaY(initializer.deltaY() ? initializer.deltaY() : negateIfPossible(initializer.wheelDeltaY()))
     , m_deltaZ(initializer.deltaZ())
     , m_deltaMode(initializer.deltaMode())
     , m_resendingPluginId(-1)
     , m_hasPreciseScrollingDeltas(false)
     , m_railsMode(RailsModeFree)
 #if OS(MACOSX)
     , m_phase(WheelEventPhaseNone)
     , m_momentumPhase(WheelEventPhaseNone)
 #endif
 {
@@ skipping 69 matching lines @@
 {
     return EventDispatchMediator::create(this);
 }
 
 DEFINE_TRACE(WheelEvent)
 {
     MouseEvent::trace(visitor);
 }
 
 } // namespace blink