Prevent integer wrap around for malloc size when creating a SkRegion
Review URL: https://codereview.chromium.org/1143603003
bug:20883006
Change-Id: I0472c2b93bdf5f3bf291aaabe11a32e78497dcda
diff --git a/src/core/SkRegionPriv.h b/src/core/SkRegionPriv.h
index c8f000d..00feede 100644
--- a/src/core/SkRegionPriv.h
+++ b/src/core/SkRegionPriv.h
@@ -65,7 +65,10 @@
SkASSERT(count >= SkRegion::kRectRegionRuns);
- RunHead* head = (RunHead*)sk_malloc_throw(sizeof(RunHead) + count * sizeof(RunType));
+ const int64_t size = sk_64_mul(count, sizeof(RunType)) + sizeof(RunHead);
+ if (count < 0 || !sk_64_isS32(size)) { SK_CRASH(); }
+
+ RunHead* head = (RunHead*)sk_malloc_throw(size);
head->fRefCnt = 1;
head->fRunCount = count;
// these must be filled in later, otherwise we will be invalid