Verify size_t overflow

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1187 matching lines @@
 
     // If there was an error reading "info", don't use it to compute minRowBytes()
     if (!buffer->validate(true)) {
         return false;
     }
 
     const size_t ramRB = info.minRowBytes();
     const int height = info.height();
     const size_t snugSize = snugRB * height;
     const size_t ramSize = ramRB * height;
-    if (!buffer->validate(snugSize <= ramSize)) {
+    if (!buffer->validate((snugSize <= ramSize) && ((ramSize / ramRB) == height))) {

[reed1, 2015/01/06 22:29:34]

perhaps we can explicitly use int64_t. We have handy macros to promote 32bit
args to make the multiply correct.

e.g.

int64_t snugSize = sk_64_mul(snugRB, height);
int64_t ramSize = sk_64_mul(ramRB, height);
...

When you explicitly need the value in 32bits, you can use

if (sk_64_isS32(ramSize))
   ...

         return false;
     }
 
     SkAutoDataUnref data(SkData::NewUninitialized(ramSize));
     char* dst = (char*)data->writable_data();
     buffer->readByteArray(dst, snugSize);
 
     if (snugSize != ramSize) {
         const char* srcRow = dst + snugRB * (height - 1);
         char* dstRow = dst + ramRB * (height - 1);
@@ skipping 159 matching lines @@
 ///////////////////////////////////////////////////////////////////////////////
 
 #ifdef SK_DEBUG
 void SkImageInfo::validate() const {
     SkASSERT(fWidth >= 0);
     SkASSERT(fHeight >= 0);
     SkASSERT(SkColorTypeIsValid(fColorType));
     SkASSERT(SkAlphaTypeIsValid(fAlphaType));
 }
 #endif