Fix integer-overflow in blink::IntRect::uniteEvenIfEmpty

third_party/WebKit/Source/platform/geometry/IntRect.cpp

 /*
  * Copyright (C) 2003, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 25 matching lines @@
 namespace blink {
 
 IntRect::IntRect(const FloatRect& r)
     : m_location(clampTo<int>(r.x()), clampTo<int>(r.y())),
       m_size(clampTo<int>(r.width()), clampTo<int>(r.height())) {}
 
 IntRect::IntRect(const LayoutRect& r)
     : m_location(r.x().toInt(), r.y().toInt()),
       m_size(r.width().toInt(), r.height().toInt()) {}
 
+// Use long instead of int to avoid undefined behavior of storing -2147483648
+static inline int GetClampedDiff(const long& a, const long& b) {
+  return a - b <= std::numeric_limits<int>::max()
+             ? a - b
+             : std::numeric_limits<int>::max();
+}
+
 bool IntRect::intersects(const IntRect& other) const {
   // Checking emptiness handles negative widths as well as zero.
   return !isEmpty() && !other.isEmpty() && x() < other.maxX() &&
          other.x() < maxX() && y() < other.maxY() && other.y() < maxY();
 }
 
 bool IntRect::contains(const IntRect& other) const {
   return x() <= other.x() && maxX() >= other.maxX() && y() <= other.y() &&
          maxY() >= other.maxY();
 }
 
 void IntRect::intersect(const IntRect& other) {
   int left = std::max(x(), other.x());
   int top = std::max(y(), other.y());
   int right = std::min(maxX(), other.maxX());
   int bottom = std::min(maxY(), other.maxY());
 
   // Return a clean empty rectangle for non-intersecting cases.
   if (left >= right || top >= bottom) {
     left = 0;
     top = 0;
     right = 0;
     bottom = 0;
   }
 
   m_location.setX(left);
   m_location.setY(top);
-  m_size.setWidth(right - left);
-  m_size.setHeight(bottom - top);
+  m_size.setWidth(GetClampedDiff(right, left));
+  m_size.setHeight(GetClampedDiff(bottom, top));
 }
 
 void IntRect::unite(const IntRect& other) {
   // Handle empty special cases first.
   if (other.isEmpty())
     return;
   if (isEmpty()) {
     *this = other;
     return;
   }
@@ skipping 14 matching lines @@
 }
 
 void IntRect::uniteEvenIfEmpty(const IntRect& other) {
   int left = std::min(x(), other.x());
   int top = std::min(y(), other.y());
   int right = std::max(maxX(), other.maxX());
   int bottom = std::max(maxY(), other.maxY());
 
   m_location.setX(left);
   m_location.setY(top);
-  m_size.setWidth(right - left);
-  m_size.setHeight(bottom - top);
+  m_size.setWidth(GetClampedDiff(right, left));
+  m_size.setHeight(GetClampedDiff(bottom, top));
 }
 
 void IntRect::scale(float s) {
   m_location.setX((int)(x() * s));
   m_location.setY((int)(y() * s));
   m_size.setWidth((int)(width() * s));
   m_size.setHeight((int)(height() * s));
 }
 
 static inline int distanceToInterval(int pos, int start, int end) {
@@ skipping 47 matching lines @@
 
   return result;
 }
 
 String IntRect::toString() const {
   return String::format("%s %s", location().toString().ascii().data(),
                         size().toString().ascii().data());
 }
 
 }  // namespace blink