diff --git a/dom/canvas/ImageBitmap.cpp b/dom/canvas/ImageBitmap.cpp index 26fec5996c4b..f6d5d86cf698 100644 --- a/dom/canvas/ImageBitmap.cpp +++ b/dom/canvas/ImageBitmap.cpp @@ -5,7 +5,7 @@ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "mozilla/dom/ImageBitmap.h" - +#include "mozilla/CheckedInt.h" #include "mozilla/dom/ImageBitmapBinding.h" #include "mozilla/dom/Promise.h" #include "mozilla/dom/StructuredCloneTags.h" @@ -175,10 +175,14 @@ CropAndCopyDataSourceSurface(DataSourceSurface* aSurface, const IntRect& aCropRe + surfPortion.x * bytesPerPixel; uint8_t* dstBufferPtr = dstMap.GetData() + dest.y * dstMap.GetStride() + dest.x * bytesPerPixel; - const uint32_t copiedBytesPerRaw = surfPortion.width * bytesPerPixel; + CheckedInt copiedBytesPerRaw = + CheckedInt(surfPortion.width) * bytesPerPixel; + if (!copiedBytesPerRaw.isValid()) { + return nullptr; + } for (int i = 0; i < surfPortion.height; ++i) { - memcpy(dstBufferPtr, srcBufferPtr, copiedBytesPerRaw); + memcpy(dstBufferPtr, srcBufferPtr, copiedBytesPerRaw.value()); srcBufferPtr += srcMap.GetStride(); dstBufferPtr += dstMap.GetStride(); }