From 4447bb215c4bb4f986b8b65e72d42a1d60e50f1a Mon Sep 17 00:00:00 2001
From: "tor%cs.brown.edu"
 <tor%cs.brown.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 10 Jan 2006 22:59:48 +0000
Subject: [PATCH] Bug 322215 - check surface size.  r+a=dveditz

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@187267 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../renderer/src/cairo/nsSVGCairoSurface.cpp  | 31 +++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoSurface.cpp b/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoSurface.cpp
index d4012cbdf1f..b5e7844dd77 100644
--- a/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoSurface.cpp
+++ b/mozilla/layout/svg/renderer/src/cairo/nsSVGCairoSurface.cpp
@@ -38,6 +38,7 @@
 #include "nsCOMPtr.h"
 #include "nsSVGCairoSurface.h"
 #include "nsISVGCairoSurface.h"
+#include "prmem.h"
 #include <cairo.h>
 
 /**
@@ -87,18 +88,44 @@ nsSVGCairoSurface::~nsSVGCairoSurface()
     mSurface = nsnull;
   }
   if (mData) {
-    delete [] mData;
+    PR_Free(mData);
     mData = nsnull;
   }
 }
 
+static PRBool
+CheckSaneImageSize(PRUint32 width, PRUint32 height)
+{
+    if (width <= 0 || height <= 0)
+        return PR_FALSE;
+
+    /* check to make sure we don't overflow a 32-bit */
+    PRUint32 tmp = width * height;
+    if (tmp / height != width)
+        return PR_FALSE;
+
+    tmp = tmp * 4;
+    if (tmp / 4 != width * height)
+        return PR_FALSE;
+
+    /* reject over-wide or over-tall images */
+    const PRUint32 k64KLimit = 0x0000FFFF;
+    if (width > k64KLimit || height > k64KLimit)
+        return PR_FALSE;
+
+    return PR_TRUE;
+}
+
 nsresult
 nsSVGCairoSurface::Init(PRUint32 width, PRUint32 height)
 {
   mWidth = width;
   mHeight = height;
 
-  mData = new PRUint8[4*width*height];
+  if (!CheckSaneImageSize(width, height))
+    return NS_ERROR_FAILURE;
+
+  mData = (PRUint8 *)PR_Malloc(4*width*height);
 
   if (!mData)
     return NS_ERROR_OUT_OF_MEMORY;