Fix integer overflow in ObjectPainter and divide by zero in Color.

third_party/WebKit/Source/core/paint/ObjectPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/ObjectPainter.h"
 
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutObject.h"
 #include "core/layout/LayoutTheme.h"
@@ skipping 197 matching lines @@
   path.lineTo(quad[1]);
   path.lineTo(quad[2]);
   path.lineTo(quad[3]);
   SkPaint paint(context.fillPaint());
   paint.setAntiAlias(antialias);
   paint.setColor(color.rgb());
 
   context.drawPath(path, paint);
 }
 
+int safeSubtract(int a, int b) {

[pdr., 2016/10/07 22:14:35]

I think you can use the existing code in SaturatedArithmetic.h

[wkorman, 2016/10/07 23:43:19]

Done.

+  if (((b < 0) && (a > std::numeric_limits<int>::max() + b)) ||
+      ((b > 0) && (a < std::numeric_limits<int>::min() + b)))
+    return a;
+  return a - b;
+}
+
+int safeAdd(int a, int b) {
+  if (((b > 0) && (a > std::numeric_limits<int>::max() - b)) ||
+      ((b < 0) && (a < std::numeric_limits<int>::min() - b)))
+    return a;
+  return a + b;
+}
+
 }  // namespace
 
 void ObjectPainter::paintOutline(const PaintInfo& paintInfo,
                                  const LayoutPoint& paintOffset) {
   ASSERT(shouldPaintSelfOutline(paintInfo.phase));
 
   const ComputedStyle& styleToUse = m_layoutObject.styleRef();
   if (!styleToUse.hasOutline() ||
       styleToUse.visibility() != EVisibility::Visible)
     return;
@@ skipping 115 matching lines @@
                                        int y2,
                                        BoxSide side,
                                        Color color,
                                        EBorderStyle style,
                                        int adjacentWidth1,
                                        int adjacentWidth2,
                                        bool antialias) {
   int thickness;
   int length;
   if (side == BSTop || side == BSBottom) {
-    thickness = y2 - y1;
-    length = x2 - x1;
+    thickness = safeSubtract(y2, y1);
+    length = safeSubtract(x2, x1);
   } else {
-    thickness = x2 - x1;
-    length = y2 - y1;
+    thickness = safeSubtract(x2, x1);
+    length = safeSubtract(y2, y1);
   }
 
   // We would like this check to be an ASSERT as we don't want to draw empty
   // borders. However nothing guarantees that the following recursive calls to
   // drawLineForBoxSide will have positive thickness and length.
   if (length <= 0 || thickness <= 0)
     return;
 
   if (style == BorderStyleDouble && thickness < 3)
     style = BorderStyleSolid;
@@ skipping 217 matching lines @@
           (x1 + x2 + 1) / 2, y2 - std::max(-adjacentWidth2, 0) / 2, side, color,
           s1, adjacent1BigHalf, adjacent2BigHalf, antialias);
       drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2,
                          y1 + std::max(adjacentWidth1 + 1, 0) / 2, x2,
                          y2 - std::max(adjacentWidth2 + 1, 0) / 2, side, color,
                          s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
       break;
     case BSBottom:
       drawLineForBoxSide(graphicsContext, x1 + std::max(adjacentWidth1, 0) / 2,
                          y1, x2 - std::max(adjacentWidth2, 0) / 2,
-                         (y1 + y2 + 1) / 2, side, color, s2, adjacent1BigHalf,
-                         adjacent2BigHalf, antialias);
+                         safeAdd(y1, safeAdd(y2, 1)) / 2, side, color, s2,
+                         adjacent1BigHalf, adjacent2BigHalf, antialias);
       drawLineForBoxSide(
           graphicsContext, x1 + std::max(-adjacentWidth1 + 1, 0) / 2,
-          (y1 + y2 + 1) / 2, x2 - std::max(-adjacentWidth2 + 1, 0) / 2, y2,
-          side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
+          safeAdd(y1, safeAdd(y2, 1)) / 2,
+          x2 - std::max(-adjacentWidth2 + 1, 0) / 2, y2, side, color, s1,
+          adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
       break;
     case BSRight:
       drawLineForBoxSide(
           graphicsContext, x1, y1 + std::max(adjacentWidth1, 0) / 2,
           (x1 + x2 + 1) / 2, y2 - std::max(adjacentWidth2, 0) / 2, side, color,
           s2, adjacent1BigHalf, adjacent2BigHalf, antialias);
       drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2,
                          y1 + std::max(-adjacentWidth1 + 1, 0) / 2, x2,
                          y2 - std::max(-adjacentWidth2 + 1, 0) / 2, side, color,
                          s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
@@ skipping 76 matching lines @@
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseFloat;
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseForeground;
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseOutline;
   m_layoutObject.paint(info, paintOffset);
 }
 
 }  // namespace blink