Fix signed integer overflow in ImageData

third_party/WebKit/Source/core/html/ImageDataTest.cpp

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/html/ImageData.h"
+
+#include "platform/geometry/IntSize.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+namespace {
+
+class ImageDataTest : public ::testing::Test {
+ protected:
+  ImageDataTest(){};
+  void TearDown(){};
+};
+
+TEST_F(ImageDataTest, NegativeAndZeroIntSizeTest) {
+  ImageData* imageData;
+
+  imageData = ImageData::create(IntSize(0, 10));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(10, 0));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(0, 0));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(-1, 10));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(10, -1));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(-1, -1));

[Justin Novosad, 2017/03/20 18:03:33]

You forgot to cover large values that overflow into the sign bit.  For example
the clusterfuzz use case for the bug you are fixing uses (32524, 32587)

[zakerinasab, 2017/03/20 20:50:33]

Thanks for the hint. New test added.

+  EXPECT_EQ(imageData, nullptr);
+}
+
+}  // namspace
+}  // namespace blink