Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/CSSSelector.cpp

 /*
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  *               2001 Andreas Schlapbach (schlpbch@iam.unibe.ch)
  *               2001-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
@@ skipping 907 matching lines @@
   }
   return link_match_type;
 }
 
 void CSSSelector::SetNth(int a, int b) {
   CreateRareData();
   data_.rare_data_->bits_.nth_.a_ = a;
   data_.rare_data_->bits_.nth_.b_ = b;
 }
 
-bool CSSSelector::MatchNth(int count) const {
+bool CSSSelector::MatchNth(unsigned count) const {
   DCHECK(has_rare_data_);
   return data_.rare_data_->MatchNth(count);
 }
 
 bool CSSSelector::MatchesPseudoElement() const {
   for (const CSSSelector* current = this; current;
        current = current->TagHistory()) {
     if (current->Match() == kPseudoElement)
       return true;
     if (current->Relation() != kSubSelector)
@@ skipping 60 matching lines @@
 CSSSelector::RareData::RareData(const AtomicString& value)
     : matching_value_(value),
       serializing_value_(value),
       bits_(),
       attribute_(AnyQName()),
       argument_(g_null_atom) {}
 
 CSSSelector::RareData::~RareData() {}
 
 // a helper function for checking nth-arguments
-bool CSSSelector::RareData::MatchNth(int count) {
+bool CSSSelector::RareData::MatchNth(unsigned unsigned_count) {
+  // These very large values for aN + B or count can't ever match, so
+  // give up immediately if we see them.
+  int max_value = std::numeric_limits<int>::max() / 2;
+  int min_value = std::numeric_limits<int>::min() / 2;
+  if (UNLIKELY(unsigned_count > static_cast<unsigned>(max_value) ||
+               NthAValue() > max_value || NthAValue() < min_value ||
+               NthBValue() > max_value || NthBValue() < min_value))
+    return false;
+
+  int count = static_cast<int>(unsigned_count);
   if (!NthAValue())
     return count == NthBValue();
   if (NthAValue() > 0) {
     if (count < NthBValue())
       return false;
     return (count - NthBValue()) % NthAValue() == 0;
   }
   if (count > NthBValue())
     return false;
   return (NthBValue() - count) % (-NthAValue()) == 0;
 }
 
 }  // namespace blink