Fix int overflow in GLES2DecoderImpl::DoDrawArrays

gpu/command_buffer/service/gles2_cmd_decoder.cc

Index: gpu/command_buffer/service/gles2_cmd_decoder.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 86074df50854075905257ab394e55fb06e0683f7..a3c4575497f7fbeb0126d5d214975354c502125e 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -9367,7 +9367,11 @@ error::Error GLES2DecoderImpl::DoDrawArrays(
     return error::kNoError;
   }
 
-  GLuint max_vertex_accessed = first + count - 1;
+  base::CheckedNumeric<GLuint> checked_max_vertex = first;
+  checked_max_vertex += count - 1;
+  // first and count-1 are both a non-negative int, so their sum fits an
+  // unsigned int.
+  GLuint max_vertex_accessed = checked_max_vertex.ValueOrDie();
   if (IsDrawValid(function_name, max_vertex_accessed, instanced, primcount)) {
     if (!ClearUnclearedTextures()) {
       LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, function_name, "out of memory");