commit 8a3e0b31927ae78bc3e9c342b1290a6a64233674
author Herb Derby <herb@google.com> Fri Feb 23 14:45:36 2018 -0500
committer Hal Canary <halcanary@google.com> Fri Mar 16 14:14:40 2018 +0000
tree c01ead3bbb6133c6254412f54aef567e46291cf4
parent bd0dafbc8112f6cfa92a8096d8cb5696d8535ef9

Fix overflow in number of bytes to erase.

The width and the height were multiplied as int * int.
Now it is int64_t * int64_t.

BUG=chromium:812519

Change-Id: If60bbdd8ee92748559b2e4f3ab57e4463a8006e8
Reviewed-on: https://skia-review.googlesource.com/109781
Reviewed-by: Florin Malita <fmalita@chromium.org>
Commit-Queue: Herb Derby <herb@google.com>
(cherry picked from commit 78663f9dad1235e47c2fa9cfd1a9dd979d373871)
Reviewed-on: https://skia-review.googlesource.com/113780
Reviewed-by: Hal Canary <halcanary@google.com>

src/core/SkPixmap.cpp

diff --git a/src/core/SkPixmap.cpp b/src/core/SkPixmap.cpp
index 7873a9b..ca86c7b 100644
--- a/src/core/SkPixmap.cpp
+++ b/src/core/SkPixmap.cpp
@@ -121,7 +121,7 @@
           && width == this->rowBytesAsPixels()
           && inArea == this->bounds()) {
         // All formats represent SkColor(0) as byte 0.
-        memset(this->writable_addr(), 0, height * rowBytes);
+        memset(this->writable_addr(), 0, (int64_t)height * rowBytes);
         return true;
     }