Adding check on input count

Adding check on input count

An integer overflow is causing a memory allocation to succeed while it should fail for being too large.

BUG=445810
Committed: https://skia.googlesource.com/skia/+/23d432080cb8506bf8e371b1637ce8f2de9c0c05

[sugoi1, 2015-01-07 19:08:26]

sugoi@chromium.org changed reviewers:
+ reed@google.com

[reed1, 2015-01-07 19:24:57]

reed@google.com changed reviewers:
+ mtklein@google.com

[reed1, 2015-01-07 19:24:57]

Hmm, I think we should just crash, since the requested size is just to big. With
this CL we have to remember to always check the result of something that used to
always succeed (or crash).

Counter proposal : lets change sk_malloc_throw (called by SkAutoSTArray (called
by fInputs.reset(count)) to detect this overflow (count * sizeof(T)) and crash!

We can vc/chat about this if you like

[Stephen White, 2015-01-07 19:31:11]

senorblanco@chromium.org changed reviewers:
+ senorblanco@chromium.org

[Stephen White, 2015-01-07 19:31:12]

https://codereview.chromium.org/831583004/diff/1/src/core/SkImageFilter.cpp
File src/core/SkImageFilter.cpp (right):

https://codereview.chromium.org/831583004/diff/1/src/core/SkImageFilter.cpp#n...
src/core/SkImageFilter.cpp:66: static const size_t maxInputs = ((size_t)(-1)) /
sizeof(SkImageFilter*);
Division is kind of ugly. Could be (moving size computation up):

const uint64_t size64 = sk_mul_64(count, sizeof(SkImageFilter*));
const size_t size = (size_t) size64;
if (size != size64) {
  return false;
}

[sugoi1, 2015-01-07 20:37:31]

Implemented reed@'s proposition

[reed1, 2015-01-07 21:17:46]

lgtm

later we may consider more sweeping ways to catch all malloc callers, but this
is a good start.

[sugoi1, 2015-01-07 21:18:01]

The CQ bit was checked by sugoi@chromium.org

[commit-bot: I haz the power, 2015-01-07 21:18:24]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/831583004/20001

[commit-bot: I haz the power, 2015-01-07 21:28:11]

Committed patchset #2 (id:20001) as
https://skia.googlesource.com/skia/+/23d432080cb8506bf8e371b1637ce8f2de9c0c05