commit 8b3707d60c2f8c8b6c425c22ce5a49df5e053881
author djsollen <djsollen@google.com> Mon May 18 13:05:11 2015 -0700
committer The Android Automerger <android-build@google.com> Fri Aug 14 12:02:23 2015 -0700
tree 846aa9e64aed004afc0976bda45b3756aa197d91
parent 891cac5baba27a9d509c0a88980fbc127a5c645e

DO NOT MERGE Prevent integer wrap around for malloc size when creating a SkRegion

Review URL: https://codereview.chromium.org/1143603003

Uses sk_64_mul instead of Sk64

bug:20883006
(cherry picked from commit 181f49c7acb67ad009f6deceb3b5cc0a45220ab4)

Change-Id: If93c6b957ea2f31b882cc272268700e415f724c5

src/core/SkRegionPriv.h

diff --git a/src/core/SkRegionPriv.h b/src/core/SkRegionPriv.h
index c8f000d..00feede 100644
--- a/src/core/SkRegionPriv.h
+++ b/src/core/SkRegionPriv.h
@@ -65,7 +65,10 @@
 
         SkASSERT(count >= SkRegion::kRectRegionRuns);
 
-        RunHead* head = (RunHead*)sk_malloc_throw(sizeof(RunHead) + count * sizeof(RunType));
+        const int64_t size = sk_64_mul(count, sizeof(RunType)) + sizeof(RunHead);
+        if (count < 0 || !sk_64_isS32(size)) { SK_CRASH(); }
+
+        RunHead* head = (RunHead*)sk_malloc_throw(size);
         head->fRefCnt = 1;
         head->fRunCount = count;
         // these must be filled in later, otherwise we will be invalid