Fix a bug in the size computation for Skia masking.

BUG=10736

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@14454 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 14 insertions, 2 deletions

diff --git a/skia/sgl/SkMask.cpp b/skia/sgl/SkMask.cpp
index b237639..7ec06be 100644
--- a/skia/sgl/SkMask.cpp
+++ b/skia/sgl/SkMask.cpp
@@ -15,19 +15,31 @@
 ** limitations under the License.
 */
 
+#include <limits>
+
 #include "SkMask.h"
 
 size_t SkMask::computeImageSize() const
 {
-    return fBounds.height() * fRowBytes;
+    // Prevent too large a number. There is a better fix for this in Skia
+    // trunk where it returns failure.
+    long long size = (long long)fBounds.height() * (long long)fRowBytes;
+    if (size >= std::numeric_limits<size_t>::max() / 2)
+        __debugbreak();
+
+    return size;
 }
 
 size_t SkMask::computeTotalImageSize() const
 {
     size_t size = this->computeImageSize();
 
-    if (fFormat == SkMask::k3D_Format)
+    if (fFormat == SkMask::k3D_Format) {
+        // See computeImageSize for why we want to stop here.
+        if (size > std::numeric_limits<size_t>::max() / 3)
+            __debugbreak();
         size *= 3;
+    }
     return size;
 }