diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 2cd762c75b0..3024ca4f25e 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -10008,19 +10008,24 @@ nsresult nsContentUtils::CalculateBufferSizeForImage(
     const uint32_t& aStride, const IntSize& aImageSize,
     const SurfaceFormat& aFormat, size_t* aMaxBufferSize,
     size_t* aUsedBufferSize) {
-  using CheckedSize = CheckedInt<size_t>;
-
-  CheckedSize padding = CheckedSize(aStride) - (CheckedSize(aImageSize.width) *
-                                                BytesPerPixel(aFormat));
-  CheckedSize requiredBytes =
-      CheckedSize(aStride) * CheckedSize(aImageSize.height);
-  CheckedSize usedBytes = requiredBytes - padding;
-  if (!usedBytes.isValid()) {
+  if (aImageSize.width <= 0 || aImageSize.height <= 0) {
+    return NS_ERROR_FAILURE;
+  }
+
+  CheckedInt32 rowBytes =
+      CheckedInt32(aImageSize.width) * BytesPerPixel(aFormat);
+  CheckedInt32 stride(aStride);
+  if (!rowBytes.isValid() || !stride.isValid() ||
+      stride.value() < rowBytes.value()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  CheckedInt32 requiredBytes = stride * CheckedInt32(aImageSize.height);
+  CheckedInt32 usedBytes = requiredBytes - stride + rowBytes;
+  if (!requiredBytes.isValid() || !usedBytes.isValid()) {
     return NS_ERROR_FAILURE;
   }
 
-  MOZ_ASSERT(requiredBytes.isValid(), "requiredBytes should be valid");
-  MOZ_ASSERT(padding.isValid(), "padding should be valid");
   *aMaxBufferSize = requiredBytes.value();
   *aUsedBufferSize = usedBytes.value();
   return NS_OK;