check for too-large rowBytes

src/core/SkMallocPixelRef.cpp

 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkMallocPixelRef.h"
 #include "SkBitmap.h"
 #include "SkReadBuffer.h"
@@ skipping 38 matching lines @@
 }
 
 
 SkMallocPixelRef* SkMallocPixelRef::NewAllocate(const SkImageInfo& info,
                                                 size_t requestedRowBytes,
                                                 SkColorTable* ctable) {
     if (!is_valid(info, ctable)) {
         return NULL;
     }
 
-    int32_t minRB = SkToS32(info.minRowBytes());
-    if (minRB < 0) {
+    // only want to permit 31bits of rowBytes
+    int64_t minRB = (int64_t)info.minRowBytes64();
+    if (minRB < 0 || !sk_64_isS32(minRB)) {
         return NULL;    // allocation will be too large
     }
     if (requestedRowBytes > 0 && (int32_t)requestedRowBytes < minRB) {
         return NULL;    // cannot meet requested rowbytes
     }
 
     int32_t rowBytes;
     if (requestedRowBytes) {
         rowBytes = SkToS32(requestedRowBytes);
     } else {
@@ skipping 127 matching lines @@
 size_t SkMallocPixelRef::getAllocatedSizeInBytes() const {
     return this->info().getSafeSize(fRB);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 SkPixelRef* SkMallocPixelRef::PRFactory::create(const SkImageInfo& info, size_t rowBytes,
                                                 SkColorTable* ctable) {
     return SkMallocPixelRef::NewAllocate(info, rowBytes, ctable);
 }