Fix for #618267. Adding a method to determine if multiplication has

core/fxcodec/codec/fx_codec_tiff.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/codec/codec_int.h"
 #include "core/fxcodec/include/fx_codec.h"
 #include "core/fxge/include/fx_dib.h"
 
@@ skipping 61 matching lines @@
 }
 
 void _TIFFmemcpy(void* des, const void* src, tmsize_t size) {
   FXSYS_memcpy(des, src, (size_t)size);
 }
 
 int _TIFFmemcmp(const void* ptr1, const void* ptr2, tmsize_t size) {
   return FXSYS_memcmp(ptr1, ptr2, (size_t)size);
 }
 
+int _TIFFIfMultiplicationOverflow(tmsize_t op1, tmsize_t op2) {

[Tom Sepez, 2016/08/26 23:05:28]

Should be bool return value.  Also, we return true when it doesn't overflow
(right?), which is opposite of what the name suggests to me.  Maybe
_TIFFMultiplicationSafeFromOverflow() or some such?

[tracy_jiang, 2016/08/26 23:44:16]

We will change the naming logic. It made sense to us.
The reason we used int was that this method is declared in
third_party/libtiff/tiffio.h. tiffio.h holds a bunch of 
C function signatures and will not allow 'bool' to be compiled
We declared it in tiffio.h was because other tiff auxiliary
methods are declared in the same place like _TIFFmemcpy etc.
Also in libtiff there is not a thing similar to FX_BOOL in
non-third-party places.
So do you think we should use int here or should we typedef a 
TIFF_BOOL?

+  return op1 <= std::numeric_limits<tmsize_t>::max() / op2;
+}
+
 TIFFErrorHandler _TIFFwarningHandler = nullptr;
 TIFFErrorHandler _TIFFerrorHandler = nullptr;
 
 namespace {
 
 tsize_t tiff_read(thandle_t context, tdata_t buf, tsize_t length) {
   CCodec_TiffContext* pTiffContext = (CCodec_TiffContext*)context;
   if (!pTiffContext->io_in()->ReadBlock(buf, pTiffContext->offset(), length))
     return 0;
 
@@ skipping 359 matching lines @@
 }
 
 bool CCodec_TiffModule::Decode(CCodec_TiffContext* ctx,
                                class CFX_DIBitmap* pDIBitmap) {
   return ctx->Decode(pDIBitmap);
 }
 
 void CCodec_TiffModule::DestroyDecoder(CCodec_TiffContext* ctx) {
   delete ctx;
 }