Check for integer overflow in allocations.

third_party/WebKit/Source/platform/wtf/TerminatedArray.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #ifndef TerminatedArray_h
 #define TerminatedArray_h
 
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/PtrUtil.h"
 #include "platform/wtf/VectorTraits.h"
 #include "platform/wtf/allocator/Partitions.h"
@@ skipping 80 matching lines @@
   struct Allocator {
     STATIC_ONLY(Allocator);
     using PassPtr = std::unique_ptr<TerminatedArray>;
     using Ptr = std::unique_ptr<TerminatedArray>;
 
     static PassPtr Release(Ptr& ptr) { return ptr.release(); }
 
     static PassPtr Create(size_t capacity) {
       return WTF::WrapUnique(
           static_cast<TerminatedArray*>(WTF::Partitions::FastMalloc(
-              capacity * sizeof(T), WTF_HEAP_PROFILER_TYPE_NAME(T))));
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T)),
+              WTF_HEAP_PROFILER_TYPE_NAME(T))));
     }
 
     static PassPtr Resize(Ptr ptr, size_t capacity) {
-      return WTF::WrapUnique(static_cast<TerminatedArray*>(
-          WTF::Partitions::FastRealloc(ptr.release(), capacity * sizeof(T),
-                                       WTF_HEAP_PROFILER_TYPE_NAME(T))));
+      return WTF::WrapUnique(
+          static_cast<TerminatedArray*>(WTF::Partitions::FastRealloc(
+              ptr.release(),
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T)),
+              WTF_HEAP_PROFILER_TYPE_NAME(T))));
     }
   };
 
   // Prohibit construction. Allocator makes TerminatedArray instances for
   // TerminatedArrayBuilder by pointer casting.
   TerminatedArray();
 
   template <typename, template <typename> class>
   friend class TerminatedArrayBuilder;
 };
 
 }  // namespace WTF
 
 using WTF::TerminatedArray;
 
 #endif  // TerminatedArray_h