Fix potential integer overflow when initializing Rect.

pdf/draw_utils.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/draw_utils.h"
 
 #include <algorithm>
 #include <math.h>
 #include <vector>
 
 #include "base/logging.h"
+#include "base/numerics/safe_math.h"
 
 namespace chrome_pdf {
 
 inline uint8 GetBlue(const uint32& pixel) {
   return static_cast<uint8>(pixel & 0xFF);
 }
 
 inline uint8 GetGreen(const uint32& pixel) {
   return static_cast<uint8>((pixel >> 8) & 0xFF);
 }
@@ skipping 123 matching lines @@
                pp::ImageData* dest, const pp::Rect& dest_rc,
                bool stretch) {
   DCHECK(src_rc.width() <= dest_rc.width() &&
       src_rc.height() <= dest_rc.height());
 
   const uint32_t* src_origin_pixel = src.GetAddr32(src_rc.point());
   uint32_t* dest_origin_pixel = dest->GetAddr32(dest_rc.point());
   if (stretch) {
     double x_ratio = static_cast<double>(src_rc.width()) / dest_rc.width();
     double y_ratio = static_cast<double>(src_rc.height()) / dest_rc.height();
-    int height = dest_rc.height();
-    int width = dest_rc.width();
-    for (int y = 0; y < height; y++) {
+    int32_t height = dest_rc.height();
+    int32_t width = dest_rc.width();
+    for (int32_t y = 0; y < height; ++y) {
       uint32_t* dest_pixel = dest_origin_pixel;
-      for (int x = 0; x < width; x++) {
+      for (int32_t x = 0; x < width; ++x) {
         uint32 src_x = static_cast<uint32>(x * x_ratio);
         uint32 src_y = static_cast<uint32>(y * y_ratio);
         const uint32_t* src_pixel = src.GetAddr32(
             pp::Point(src_rc.x() + src_x, src_rc.y() + src_y));
         *dest_pixel = *src_pixel;
         dest_pixel++;
       }
       dest_origin_pixel = reinterpret_cast<uint32_t*>(
           reinterpret_cast<char*>(dest_origin_pixel) + dest->stride());
     }
   } else {
-    int height = src_rc.height();
-    int width_bytes = src_rc.width() * 4;
-    for (int y = 0; y < height; y++) {
-      memcpy(dest_origin_pixel, src_origin_pixel, width_bytes);
+    int32_t height = src_rc.height();
+    base::CheckedNumeric<int32_t> width_bytes = src_rc.width();
+    width_bytes *= 4;
+    for (int32_t y = 0; y < height; ++y) {
+      memcpy(dest_origin_pixel, src_origin_pixel, width_bytes.ValueOrDie());
       src_origin_pixel = reinterpret_cast<const uint32_t*>(
           reinterpret_cast<const char*>(src_origin_pixel) + src.stride());
       dest_origin_pixel = reinterpret_cast<uint32_t*>(
           reinterpret_cast<char*>(dest_origin_pixel) + dest->stride());
     }
   }
 }
 
 void FillRect(pp::ImageData* image, const pp::Rect& rc, uint32 color) {
   int height = rc.height();
@@ skipping 130 matching lines @@
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 
   // Fill right part.
   rc = pp::Rect(object_rc.right(), object_rc.y(),
                 shadow_rc.right() - object_rc.right(), object_rc.height());
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 }
 
 }  // namespace chrome_pdf