commit 683d84baed9e6b453f6660c1a21e0fe5dc35e7bb
author Herb Derby <herb@google.com> Tue Aug 15 16:42:59 2017 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Wed Aug 16 15:32:46 2017 +0000
tree 0db0a5c96ce65caf94d81194ab9e783dcd3f0d47
parent c7f2676ba0f93900209730cb5cf784e603c410d2

Use SkSafeMath to calculate memory sizes.

BUG=chromium:749147

Change-Id: I07d18e089be1138ad83bfde392c7daf2d01d388c
Reviewed-on: https://skia-review.googlesource.com/34747
Commit-Queue: Herb Derby <herb@google.com>
Reviewed-by: Mike Klein <mtklein@chromium.org>

src/core/SkMaskBlurFilter.cpp

diff --git a/src/core/SkMaskBlurFilter.cpp b/src/core/SkMaskBlurFilter.cpp
index 43616c3..14147f0 100644
--- a/src/core/SkMaskBlurFilter.cpp
+++ b/src/core/SkMaskBlurFilter.cpp
@@ -10,6 +10,7 @@
 #include <cmath>
 
 #include "SkMakeUnique.h"
+#include "SkSafeMath.h"
 
 static const double kPi = 3.14159265358979323846264338327950288;
 
@@ -109,8 +110,12 @@
     size_t srcW = src.fBounds.width();
     size_t srcH = src.fBounds.height();
 
-    size_t dstW = srcW + 2 * borderW;
-    size_t dstH = srcH + 2 * borderH;
+    SkSafeMath safe;
+
+    // size_t dstW = srcW + 2 * borderW;
+    size_t dstW = safe.add(srcW, safe.add(borderW, borderW));
+    //size_t dstH = srcH + 2 * borderH;
+    size_t dstH = safe.add(srcH, safe.add(borderH, borderH));
 
     dst->fBounds.set(0, 0, dstW, dstH);
     dst->fBounds.offset(src.fBounds.x(), src.fBounds.y());
@@ -124,7 +129,13 @@
         return {SkTo<int32_t>(borderW), SkTo<int32_t>(borderH)};
     }
 
-    dst->fImage = SkMask::AllocImage(dstW * dstH);
+    size_t toAlloc = safe.mul(dstW, dstH);
+    if (!safe) {
+        // There is no border offset because we are not drawing.
+        return {0, 0};
+    }
+    dst->fImage = SkMask::AllocImage(toAlloc);
+
 
     if (weightW > 1 && weightH > 1) {
         // Blur both directions.