Workaround bad bitmaps in clibpoard code

content/renderer/renderer_clipboard_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file provides the embedder's side of the Clipboard interface.
 
 #include "content/renderer/renderer_clipboard_client.h"
 
 #include "base/memory/shared_memory.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string16.h"
 #include "content/common/clipboard_messages.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/scoped_clipboard_writer_glue.h"
 #include "ui/base/clipboard/clipboard.h"
 #include "ui/gfx/size.h"
 
 namespace content {
 
@@ skipping 22 matching lines @@
 // This definition of WriteBitmapFromPixels uses shared memory to communicate
 // across processes.
 void RendererClipboardWriteContext::WriteBitmapFromPixels(
     ui::Clipboard::ObjectMap* objects,
     const void* pixels,
     const gfx::Size& size) {
   // Do not try to write a bitmap more than once
   if (shared_buf_)
     return;
 
-  uint32 buf_size = 4 * size.width() * size.height();
+  base::CheckedNumeric<uint32> checked_buf_size = 4;
+  checked_buf_size *= size.width();
+  checked_buf_size *= size.height();
+  if (!checked_buf_size.IsValid())
+    return;
+
+  uint32 buf_size = checked_buf_size.ValueOrDie();
 
   // Allocate a shared memory buffer to hold the bitmap bits.
   shared_buf_.reset(ChildThread::current()->AllocateSharedMemory(buf_size));
   if (!shared_buf_)
     return;
 
   // Copy the bits into shared memory
   DCHECK(shared_buf_->memory());
   memcpy(shared_buf_->memory(), pixels, buf_size);
   shared_buf_->Unmap();
@@ skipping 101 matching lines @@
                                              base::string16* data) {
   RenderThreadImpl::current()->Send(
       new ClipboardHostMsg_ReadCustomData(clipboard_type, type, data));
 }
 
 ClipboardClient::WriteContext* RendererClipboardClient::CreateWriteContext() {
   return new RendererClipboardWriteContext;
 }
 
 }  // namespace content