Check for integer overflow in allocations.

third_party/WebKit/Source/platform/wtf/allocator/Partitions.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Partitions_h
 #define Partitions_h
 
 #include <string.h>
 #include "base/allocator/partition_allocator/partition_alloc.h"
 #include "base/allocator/partition_allocator/spin_lock.h"
+#include "base/numerics/checked_math.h"
 #include "platform/wtf/Assertions.h"
 #include "platform/wtf/WTF.h"
 #include "platform/wtf/WTFExport.h"
 
 namespace WTF {
 
 class WTF_EXPORT Partitions {
  public:
   typedef void (*ReportPartitionAllocSizeFunction)(size_t);
 
@@ skipping 14 matching lines @@
 
   ALWAYS_INLINE static base::PartitionRootGeneric* FastMallocPartition() {
     DCHECK(initialized_);
     return fast_malloc_allocator_.root();
   }
 
   ALWAYS_INLINE static base::PartitionRoot* NodePartition() {
     NOTREACHED();
     return nullptr;
   }
+
   ALWAYS_INLINE static base::PartitionRoot* LayoutPartition() {
     DCHECK(initialized_);
     return layout_allocator_.root();
   }
 
+  ALWAYS_INLINE static size_t ComputeAllocationSize(size_t count, size_t size) {
+    base::CheckedNumeric<size_t> total = count;
+    total *= size;
+    return total.ValueOrDie();
+  }
+
   static size_t CurrentDOMMemoryUsage() {
     NOTREACHED();
     return 0;
   }
 
   static size_t TotalSizeOfCommittedPages() {
     size_t total_size = 0;
     total_size += fast_malloc_allocator_.root()->total_size_of_committed_pages;
     total_size += array_buffer_allocator_.root()->total_size_of_committed_pages;
     total_size += buffer_allocator_.root()->total_size_of_committed_pages;
@@ skipping 73 matching lines @@
 using base::PageAccessible;
 using base::PageInaccessible;
 using base::PartitionStatsDumper;
 using base::PartitionMemoryStats;
 using base::PartitionBucketMemoryStats;
 using base::PartitionAllocHooks;
 
 }  // namespace WTF
 
 #endif  // Partitions_h