Fix silent truncations when extracting values from CheckedNumeric

third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 
 #include "platform/graphics/ImageObserver.h"
 #include "platform/graphics/cpu/arm/WebGLImageConversionNEON.h"
 #include "platform/graphics/cpu/mips/WebGLImageConversionMSA.h"
 #include "platform/graphics/cpu/x86/WebGLImageConversionSSE.h"
@@ skipping 2642 matching lines @@
     CheckedNumeric<uint32_t> tmp = width;
     tmp *= bytesPerGroup;
     if (!tmp.IsValid())
       return GL_INVALID_VALUE;
     lastRowSize = tmp.ValueOrDie();
   } else {
     lastRowSize = checkedValue.ValueOrDie();
   }
 
   unsigned padding = 0;
-  unsigned residual = checkedValue.ValueOrDie() % params.alignment;
+  unsigned residual = (checkedValue % params.alignment).ValueOrDie();
   if (residual) {
     padding = params.alignment - residual;
     checkedValue += padding;
   }
   if (!checkedValue.IsValid())
     return GL_INVALID_VALUE;
   unsigned paddedRowSize = checkedValue.ValueOrDie();
 
   CheckedNumeric<uint32_t> rows = imageHeight;
   rows *= (depth - 1);
   // Last image is not affected by IMAGE_HEIGHT parameter.
   rows += height;
   if (!rows.IsValid())
     return GL_INVALID_VALUE;
-  checkedValue *= (rows.ValueOrDie() - 1);
+  checkedValue *= (rows - 1);
   // Last row is not affected by ROW_LENGTH parameter.
   checkedValue += lastRowSize;
   if (!checkedValue.IsValid())
     return GL_INVALID_VALUE;
   *imageSizeInBytes = checkedValue.ValueOrDie();
   if (paddingInBytes)
     *paddingInBytes = padding;
 
   CheckedNumeric<uint32_t> skipSize = 0;
   if (params.skipImages > 0) {
@@ skipping 475 matching lines @@
       pack<WebGLImageConversion::DataFormatRGB565,
            WebGLImageConversion::AlphaDoNothing>(srcRowStart, dstRowStart,
                                                  pixelsPerRow);
     } break;
     default:
       break;
   }
 }
 
 }  // namespace blink