Prevent overflow when growing an SkRegion's RunArray

Bug: 350118416
Test: N/A -- speculative issue without repro case
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/894836
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:85802e6d648a7831a26cc856fa5e33da94ed23f0)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:521332e28acde551bb63dbd6829e7089d73533d8)
Merged-In: Iea27fe62ef97deb8a75e8dae276657d809223b57
Change-Id: Iea27fe62ef97deb8a75e8dae276657d809223b57

src/core/SkRegion.cpp

diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
index 780a71c..c46ffa4 100644
--- a/src/core/SkRegion.cpp
+++ b/src/core/SkRegion.cpp
@@ -55,8 +55,10 @@
     /** Resize the array to a size greater-than-or-equal-to count. */
     void resizeToAtLeast(int count) {
         if (count > fCount) {
-            // leave at least 50% extra space for future growth.
-            count += count >> 1;
+            // leave at least 50% extra space for future growth (unless adding would overflow)
+            SkSafeMath safe;
+            int newCount = safe.addInt(count, count >> 1);
+            count = safe ? newCount : SK_MaxS32;
             fMalloc.realloc(count);
             if (fPtr == fStack) {
                 memcpy(fMalloc.get(), fStack, fCount * sizeof(SkRegionPriv::RunType));