Security fix: integer overflow on checking image size

webkit/plugins/ppapi/ppb_image_data_impl.cc

Index: webkit/plugins/ppapi/ppb_image_data_impl.cc
diff --git a/webkit/plugins/ppapi/ppb_image_data_impl.cc b/webkit/plugins/ppapi/ppb_image_data_impl.cc
index b318b4674f6f38b91598ea5898a06eecc6ade22a..4bdcbef853f8dafca1fbdb8783fba2de35e88cac 100644
--- a/webkit/plugins/ppapi/ppb_image_data_impl.cc
+++ b/webkit/plugins/ppapi/ppb_image_data_impl.cc
@@ -54,8 +54,8 @@ bool PPB_ImageData_Impl::Init(PP_ImageDataFormat format,
     return false;  // Only support this one format for now.
   if (width <= 0 || height <= 0)
     return false;
-  if (static_cast<int64>(width) * static_cast<int64>(height) * 4 >=
-      std::numeric_limits<int32>::max())
+  if (static_cast<int64>(width) * static_cast<int64>(height) >=
+      std::numeric_limits<int32>::max() / 4)
     return false;  // Prevent overflow of signed 32-bit ints.
 
   format_ = format;
@@ -285,4 +285,3 @@ const SkBitmap* ImageDataNaClBackend::GetMappedBitmap() const {
 
 }  // namespace ppapi
 }  // namespace webkit
-