Security fix: integer overflow on checking image size

webkit/plugins/ppapi/ppb_image_data_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_image_data_impl.h"
 
 #include <algorithm>
 #include <limits>
 
 #include "base/logging.h"
@@ skipping 36 matching lines @@
 }
 
 bool PPB_ImageData_Impl::Init(PP_ImageDataFormat format,
                               int width, int height,
                               bool init_to_zero) {
   // TODO(brettw) this should be called only on the main thread!
   if (!IsImageDataFormatSupported(format))
     return false;  // Only support this one format for now.
   if (width <= 0 || height <= 0)
     return false;
-  if (static_cast<int64>(width) * static_cast<int64>(height) * 4 >=
-      std::numeric_limits<int32>::max())
+  if (static_cast<int64>(width) * static_cast<int64>(height) >=
+      std::numeric_limits<int32>::max() / 4)
     return false;  // Prevent overflow of signed 32-bit ints.
 
   format_ = format;
   width_ = width;
   height_ = height;
   return backend_->Init(this, format, width, height, init_to_zero);
 }
 
 // static
 PP_Resource PPB_ImageData_Impl::CreatePlatform(PP_Instance instance,
@@ skipping 209 matching lines @@
 }
 
 const SkBitmap* ImageDataNaClBackend::GetMappedBitmap() const {
   if (!IsMapped())
     return NULL;
   return &skia_bitmap_;
 }
 
 }  // namespace ppapi
 }  // namespace webkit
-