Verify size_t overflow

src/core/SkBitmap.cpp

Index: src/core/SkBitmap.cpp
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index 9db596de9cc9023fe32ae9b5ba24ae473e041345..97c1396bcd3eaefc6aaf1b593f94b609327c85d6 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1205,7 +1205,7 @@ bool SkBitmap::ReadRawPixels(SkReadBuffer* buffer, SkBitmap* bitmap) {
     const int height = info.height();
     const size_t snugSize = snugRB * height;
     const size_t ramSize = ramRB * height;
-    if (!buffer->validate(snugSize <= ramSize)) {
+    if (!buffer->validate((snugSize <= ramSize) && ((ramSize / ramRB) == height))) {

[reed1, 2015/01/06 22:29:34]

perhaps we can explicitly use int64_t. We have handy macros to promote 32bit
args to make the multiply correct.

e.g.

int64_t snugSize = sk_64_mul(snugRB, height);
int64_t ramSize = sk_64_mul(ramRB, height);
...

When you explicitly need the value in 32bits, you can use

if (sk_64_isS32(ramSize))
   ...

         return false;
     }