Fix signed integer overflow in ImageData

third_party/WebKit/Source/core/html/ImageDataTest.cpp

Index: third_party/WebKit/Source/core/html/ImageDataTest.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageDataTest.cpp b/third_party/WebKit/Source/core/html/ImageDataTest.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..1a8b80af2f9e4e748787fb5ca8750a85d8b8c658
--- /dev/null
+++ b/third_party/WebKit/Source/core/html/ImageDataTest.cpp
@@ -0,0 +1,51 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/html/ImageData.h"
+
+#include "core/dom/ExceptionCode.h"
+#include "platform/geometry/IntSize.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+namespace {
+
+class ImageDataTest : public ::testing::Test {
+ protected:
+  ImageDataTest(){};
+  void TearDown(){};
+};
+
+TEST_F(ImageDataTest, NegativeAndZeroIntSizeTest) {
+  ImageData* imageData;
+
+  imageData = ImageData::create(IntSize(0, 10));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(10, 0));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(0, 0));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(-1, 10));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(10, -1));
+  EXPECT_EQ(imageData, nullptr);
+
+  imageData = ImageData::create(IntSize(-1, -1));
+  EXPECT_EQ(imageData, nullptr);
+}
+
+TEST_F(ImageDataTest, CreateImageDataTooBig) {
+  DummyExceptionStateForTesting exceptionState;
+  ImageData* tooBigImageData = ImageData::create(32767, 32767, exceptionState);

[Justin Novosad, 2017/03/21 17:07:23]

You need to add a comment here to explain the rationale of this test and what it
covers because Chrome is not strictly spec compliant here: The size arguments
are 'unsigned long' in the IDL, but they are truncated to int internally, which
leads to a very specific overflow risk, which is covered by this test (overflow
into the sign bit).

+  EXPECT_EQ(tooBigImageData, nullptr);
+  EXPECT_TRUE(exceptionState.hadException());
+  EXPECT_EQ(exceptionState.code(), V8RangeError);
+}
+
+}  // namspace
+}  // namespace blink