Merge 92413

Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 46 matching lines @@
 #include "V8Uint8Array.h"
 #include "V8WebGLBuffer.h"
 #include "V8WebGLFramebuffer.h"
 #include "V8WebGLProgram.h"
 #include "V8WebGLRenderbuffer.h"
 #include "V8WebGLShader.h"
 #include "V8WebGLTexture.h"
 #include "V8WebGLUniformLocation.h"
 #include "V8WebGLVertexArrayObjectOES.h"
 #include "WebGLRenderingContext.h"
+#include <limits>
 #include <wtf/FastMalloc.h>
 
 namespace WebCore {
 
 // Allocates new storage via tryFastMalloc.
 // Returns NULL if array failed to convert for any reason.
 static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
 {
     // Convert the data element-by-element.
     float* data;
-    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
+    if (len > std::numeric_limits<uint32_t>::max() / sizeof(float)
+        || !tryFastMalloc(len * sizeof(float)).getValue(data))
         return 0;
     for (uint32_t i = 0; i < len; i++) {
         v8::Local<v8::Value> val = array->Get(i);
         if (!val->IsNumber()) {
             fastFree(data);
             return 0;
         }
         data[i] = toFloat(val);
     }
     return data;
 }
 
 // Allocates new storage via tryFastMalloc.
 // Returns NULL if array failed to convert for any reason.
 static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
 {
     // Convert the data element-by-element.
     int* data;
-    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
+    if (len > std::numeric_limits<uint32_t>::max() / sizeof(int)
+        || !tryFastMalloc(len * sizeof(int)).getValue(data))
         return 0;
     for (uint32_t i = 0; i < len; i++) {
         v8::Local<v8::Value> val = array->Get(i);
         bool ok;
         int ival = toInt32(val, ok);
         if (!ok) {
             fastFree(data);
             return 0;
         }
         data[i] = ival;
@@ skipping 672 matching lines @@
 
 v8::Handle<v8::Value> V8WebGLRenderingContext::vertexAttrib4fvCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.WebGLRenderingContext.vertexAttrib4fv()");
     return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEBGL)