Fix signed integer overflow in ImageData

third_party/WebKit/Source/core/html/ImageData.cpp

Index: third_party/WebKit/Source/core/html/ImageData.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageData.cpp b/third_party/WebKit/Source/core/html/ImageData.cpp
index 3630b6e097d7c4dcaa79e75f2f51d9c017d5e545..6e6f3eb28dd897992d7304b9c0bceeee2dd997e3 100644
--- a/third_party/WebKit/Source/core/html/ImageData.cpp
+++ b/third_party/WebKit/Source/core/html/ImageData.cpp
@@ -122,7 +122,7 @@ bool ImageData::validateConstructorArguments(const unsigned& paramFlags,
   }
 
   if (paramFlags & kParamSize) {
-    if (!size->width() || !size->height())
+    if (size->width() <= 0 || size->height() <= 0)
       return false;
     CheckedNumeric<unsigned> dataSize = 4;
     dataSize *= size->width();
@@ -147,23 +147,26 @@ DOMArrayBufferView* ImageData::allocateAndValidateDataArray(
 
   DOMArrayBufferView* dataArray = nullptr;
   unsigned dataLength = 0;
+  unsigned dataItemLength = 1;
   switch (storageFormat) {
     case kUint8ClampedArrayStorageFormat:
       dataArray = DOMUint8ClampedArray::createOrNull(length);
-      dataLength = dataArray->view()->byteLength();
       break;
     case kUint16ArrayStorageFormat:
       dataArray = DOMUint16Array::createOrNull(length);
-      dataLength = dataArray->view()->byteLength() / 2;
+      dataItemLength = 2;
       break;
     case kFloat32ArrayStorageFormat:
       dataArray = DOMFloat32Array::createOrNull(length);
-      dataLength = dataArray->view()->byteLength() / 4;
+      dataItemLength = 4;
       break;
     default:
       NOTREACHED();
   }
 
+  if (dataArray)
+    dataLength = dataArray->view()->byteLength() / dataItemLength;
+
   if (!dataArray || length != dataLength) {
     if (exceptionState)
       exceptionState->throwDOMException(V8RangeError,
@@ -177,9 +180,11 @@ DOMArrayBufferView* ImageData::allocateAndValidateDataArray(
 ImageData* ImageData::create(const IntSize& size) {
   if (!ImageData::validateConstructorArguments(kParamSize, &size))
     return nullptr;
-  DOMArrayBufferView* byteArray = allocateAndValidateDataArray(
-      4 * size.width() * size.height(), kUint8ClampedArrayStorageFormat);
-  return new ImageData(size, byteArray);
+  DOMArrayBufferView* byteArray =
+      allocateAndValidateDataArray(4 * static_cast<unsigned>(size.width()) *
+                                       static_cast<unsigned>(size.height()),
+                                   kUint8ClampedArrayStorageFormat);
+  return byteArray ? new ImageData(size, byteArray) : nullptr;
 }
 
 // This function accepts size (0, 0) and always returns the ImageData in