Fix silent truncations when extracting values from CheckedNumeric

third_party/WebKit/Source/core/html/ImageData.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 21 matching lines @@
 #include "bindings/core/v8/V8Uint8ClampedArray.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/frame/ImageBitmap.h"
 #include "core/imagebitmap/ImageBitmapOptions.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/CheckedNumeric.h"
 
 namespace blink {
 
 ImageData* ImageData::create(const IntSize& size) {
-  CheckedNumeric<int> dataSize = 4;
+  CheckedNumeric<unsigned> dataSize = 4;
   dataSize *= size.width();
   dataSize *= size.height();
-  if (!dataSize.IsValid() || dataSize.ValueOrDie() < 0)
+  if (!dataSize.IsValid())
     return nullptr;
 
   DOMUint8ClampedArray* byteArray =
       DOMUint8ClampedArray::createOrNull(dataSize.ValueOrDie());
   if (!byteArray)
     return nullptr;
 
   return new ImageData(size, byteArray);
 }
 
 ImageData* ImageData::create(const IntSize& size,
                              DOMUint8ClampedArray* byteArray) {
-  CheckedNumeric<int> dataSize = 4;
+  CheckedNumeric<unsigned> dataSize = 4;
   dataSize *= size.width();
   dataSize *= size.height();
   if (!dataSize.IsValid())
     return nullptr;
 
-  if (dataSize.ValueOrDie() < 0 ||
-      static_cast<unsigned>(dataSize.ValueOrDie()) > byteArray->length())
+  if (!dataSize.IsValid() || dataSize.ValueOrDie() > byteArray->length())
     return nullptr;
 
   return new ImageData(size, byteArray);
 }
 
 ImageData* ImageData::create(unsigned width,
                              unsigned height,
                              ExceptionState& exceptionState) {
   if (!width || !height) {
     exceptionState.throwDOMException(
@@ skipping 138 matching lines @@
 
 ImageData::ImageData(const IntSize& size, DOMUint8ClampedArray* byteArray)
     : m_size(size), m_data(byteArray) {
   DCHECK_GE(size.width(), 0);
   DCHECK_GE(size.height(), 0);
   SECURITY_CHECK(static_cast<unsigned>(size.width() * size.height() * 4) <=
                  m_data->length());
 }
 
 }  // namespace blink