diff --git a/src/gpu/ganesh/SurfaceContext.cpp b/src/gpu/ganesh/SurfaceContext.cpp index 6eaa922ff4..9abd062ede 100644 --- a/src/gpu/ganesh/SurfaceContext.cpp +++ b/src/gpu/ganesh/SurfaceContext.cpp @@ -26,6 +26,7 @@ #include "include/private/base/SkTemplates.h" #include "include/private/base/SkTo.h" #include "include/private/gpu/ganesh/GrTypesPriv.h" +#include "src/base/SkSafeMath.h" #include "src/core/SkColorSpaceXformSteps.h" #include "src/core/SkMipmap.h" #include "src/core/SkTraceEvent.h" @@ -275,8 +276,12 @@ bool SurfaceContext::readPixels(GrDirectContext* dContext, GrPixmap dst, SkIPoin this->colorInfo().alphaType(), this->colorInfo().refColorSpace(), dst.dimensions()); - size_t tmpRB = tmpInfo.minRowBytes(); - size_t size = tmpRB * tmpInfo.height(); + SkSafeMath safe; + size_t tmpRB = safe.mul(tmpInfo.bpp(), tmpInfo.width()); + size_t size = safe.mul(tmpRB, tmpInfo.height()); + if (!safe.ok()) { + return false; + } // Chrome MSAN bots require the data to be initialized (hence the ()). tmpPixels = std::make_unique(size); tmp = {tmpInfo, tmpPixels.get(), tmpRB};