Bug 1294677 - Check for large image sizes. r=jrmuizel

mozilla-spidermonkey · Aug 25, 2016 · 7bd1c6a · 7bd1c6a
1 parent e9edffe
commit 7bd1c6a
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/dom/base/ImageEncoder.cpp b/dom/base/ImageEncoder.cpp
@@ -436,6 +436,12 @@ ImageEncoder::ExtractDataInternal(const nsAString& aType,
       imgStream = do_QueryInterface(aEncoder);
     }
   } else {
+    CheckedInt32 requiredBytes = CheckedInt32(aSize.width) * CheckedInt32(aSize.height) * 4;
+    if (MOZ_UNLIKELY(!requiredBytes.isValid())) {
+      return NS_ERROR_INVALID_ARG;
+    }
+
+
     // no context, so we have to encode an empty image
     // note that if we didn't have a current context, the spec says we're
     // supposed to just return transparent black pixels of the canvas