Merge 87171

Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 92 matching lines @@
 
 static void premultitplyScanline(void* data, size_t tileNumber)
 {
     convertScanline(data, tileNumber, true);
 }
 #endif // USE(IOSURFACE_CANVAS_BACKING_STORE)
 #endif // USE(ACCELERATE)
 
 PassRefPtr<ByteArray> ImageBufferData::getData(const IntRect& rect, const IntSize& size, bool accelerateRendering, bool unmultiplied) const
 {
+    float area = 4.0f * rect.width() * rect.height();
+    if (area > static_cast<float>(std::numeric_limits<int>::max()))
+        return 0;
+
     RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
     unsigned char* data = result->data();
     
     if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
         memset(data, 0, result->length());
     
     int originx = rect.x();
     int destx = 0;
     if (originx < 0) {
         destx = -originx;
@@ skipping 255 matching lines @@
 #endif // USE(ACCELERATE)
 
         IOSurfaceUnlock(surface, 0, 0);
 #else
         ASSERT_NOT_REACHED();
 #endif // USE(IOSURFACE_CANVAS_BACKING_STORE)
     }
 }
 
 } // namespace WebCore