Fix another FastMalloc call site with potential integer overflow.

third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp

 /*
  * This file is part of the XSL implementation.
  *
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple, Inc. All rights reserved.
  * Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 213 matching lines @@
       length, WTF_HEAP_PROFILER_TYPE_NAME(XSLTProcessor)));
   memcpy(parameter_array, data, length);
   return parameter_array;
 }
 
 static const char** XsltParamArrayFromParameterMap(
     XSLTProcessor::ParameterMap& parameters) {
   if (parameters.IsEmpty())
     return nullptr;
 
-  const char** parameter_array = static_cast<const char**>(
-      WTF::Partitions::FastMalloc(((parameters.size() * 2) + 1) * sizeof(char*),
-                                  WTF_HEAP_PROFILER_TYPE_NAME(XSLTProcessor)));
+  WTF::CheckedSizeT size = parameters.size();

[Tom Sepez, 2017/06/26 22:33:36]

Blink is pretty slap-happy about using "unsigned" for counts, lengths, etc, so
if the caclulation overflows a uint32 we probably want to bail, even if we have
64-bit size_ts.

+  size *= 2;
+  ++size;
+  size *= sizeof(char*);
+  const char** parameter_array =
+      static_cast<const char**>(WTF::Partitions::FastMalloc(
+          size.ValueOrDie(), WTF_HEAP_PROFILER_TYPE_NAME(XSLTProcessor)));
 
   unsigned index = 0;
   for (auto& parameter : parameters) {
     parameter_array[index++] =
         AllocateParameterArray(parameter.key.Utf8().data());
     parameter_array[index++] =
         AllocateParameterArray(parameter.value.Utf8().data());
   }
   parameter_array[index] = 0;
 
@@ skipping 153 matching lines @@
 
   sheet->method = orig_method;
   SetXSLTLoadCallBack(0, 0, 0);
   xsltFreeStylesheet(sheet);
   stylesheet_ = nullptr;
 
   return success;
 }
 
 }  // namespace blink