diff options
| -rw-r--r-- | chromium/third_party/skia/src/core/SkEdgeBuilder.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/chromium/third_party/skia/src/core/SkEdgeBuilder.cpp b/chromium/third_party/skia/src/core/SkEdgeBuilder.cpp index 48c1bca5ac2..853f5409fc9 100644 --- a/chromium/third_party/skia/src/core/SkEdgeBuilder.cpp +++ b/chromium/third_party/skia/src/core/SkEdgeBuilder.cpp @@ -14,6 +14,7 @@ #include "SkLineClipper.h" #include "SkPath.h" #include "SkPathPriv.h" +#include "SkSafeMath.h" #include "SkTo.h" /////////////////////////////////////////////////////////////////////////////// @@ -272,7 +273,11 @@ int SkEdgeBuilder::buildPoly(const SkPath& path, const SkIRect* iclip, int shift // clipping can turn 1 line into (up to) kMaxClippedLineSegments, since // we turn portions that are clipped out on the left/right into vertical // segments. - maxEdgeCount *= SkLineClipper::kMaxClippedLineSegments; + SkSafeMath safe; + maxEdgeCount = safe.mul(maxEdgeCount, SkLineClipper::kMaxClippedLineSegments); + if (!safe) { + return 0; + } } size_t edgeSize; |