Fix int overflow in GLES2DecoderImpl::DoDrawArrays

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 9349 matching lines @@
     LOCAL_RENDER_WARNING("Render count or primcount is 0.");
     return error::kNoError;
   }
 
   if (feature_info_->IsWebGL2OrES3Context() && !AttribsTypeMatch()) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, function_name,
         "vertexAttrib function must match shader attrib type");
     return error::kNoError;
   }
 
-  GLuint max_vertex_accessed = first + count - 1;
+  base::CheckedNumeric<GLuint> checked_max_vertex = first;
+  checked_max_vertex += count - 1;
+  // first and count-1 are both a non-negative int, so their sum fits an
+  // unsigned int.
+  GLuint max_vertex_accessed = checked_max_vertex.ValueOrDie();
   if (IsDrawValid(function_name, max_vertex_accessed, instanced, primcount)) {
     if (!ClearUnclearedTextures()) {
       LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, function_name, "out of memory");
       return error::kNoError;
     }
     bool simulated_attrib_0 = false;
     if (!SimulateAttrib0(
         function_name, max_vertex_accessed, &simulated_attrib_0)) {
       return error::kNoError;
     }
@@ skipping 8595 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu