diff --git a/dom/canvas/QueueParamTraits.h b/dom/canvas/QueueParamTraits.h
index 8ad9e4f133b..55fc3975650 100644
--- a/dom/canvas/QueueParamTraits.h
+++ b/dom/canvas/QueueParamTraits.h
@@ -438,8 +438,22 @@ struct QueueParamTraits<webgl::TexUnpackBlobDesc> {
           !view.ReadParam(&stride)) {
         return false;
       }
-      const size_t dataSize = stride * surfSize.height;
-      const auto range = view.template ReadRange<uint8_t>(dataSize);
+      if (!CheckedInt32(stride).isValid() || surfSize.IsEmpty()) {
+        return false;
+      }
+      int32_t bpp = BytesPerPixel(format);
+      CheckedInt<size_t> minStride(bpp);
+      minStride *= surfSize.width;
+      if (!minStride.isValid() || minStride.value() <= 0 ||
+          stride < minStride.value()) {
+        return false;
+      }
+      CheckedInt<size_t> dataSize(stride);
+      dataSize *= surfSize.height;
+      if (!dataSize.isValid()) {
+        return false;
+      }
+      const auto range = view.template ReadRange<uint8_t>(dataSize.value());
       if (!range) return false;
 
       // DataSourceSurface demands pointer-to-mutable.
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
index 79b5288c662..b2d558a081f 100644
--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -393,7 +393,12 @@ bool TexUnpackBlob::ConvertIfNeeded(
 
   const auto& unpacking = mDesc.unpacking;
 
-  if (!rowLength || !rowCount || srcStride <= 0 || dstStride <= 0) return true;
+  if (!rowLength || !rowCount) return true;
+
+  if (srcStride <= 0 || dstStride <= 0) {
+    webgl->ErrorInvalidOperation("Invalid stride.");
+    return false;
+  }
 
   const auto srcIsPremult = (mDesc.srcAlphaType == gfxAlphaType::Premult);
   auto dstIsPremult = unpacking.premultiplyAlpha;