Code: bool PPB_ImageData_Impl::Init(PP_ImageDataFormat format,
                              int width, int height,
                              bool init_to_zero) {
  if (!IsImageDataFormatSupported(format))
     return false;  // Only support this one format for now.
   if (width <= 0 || height <= 0)
     return false;
  if (static_cast<int64>(width) * static_cast<int64>(height) * 4 >=
      std::numeric_limits<int32>::max())
     return false;  // Prevent overflow of signed 32-bit ints.
 
   format_ = format;
  width_ = width;
  height_ = height;
  return backend_->Init(this, format, width, height, init_to_zero);
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-190
Summary: Integer overflow in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PPAPI image buffers.
Commit Message: Security fix: integer overflow on checking image size

Test is left in another CL (codereview.chromiu,.org/11274036) to avoid conflict there.  Hope it's fine.

BUG=160926


Review URL: https://chromiumcodereview.appspot.com/11410081

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@167882 0039d316-1c4b-4281-b951-d872f2087c98