Check negative getImageData params for Integer overflow

Bug: 820701
Change-Id: Ic4d4f28c9b34c41f22ff2f4daca25128f2fdf987
Reviewed-on: https://chromium-review.googlesource.com/964927Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: Mohammad Reza Zakerinasab <zakerinasab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543686}

third_party/WebKit/Source/modules/canvas/canvas2d/BaseRenderingContext2D.cpp

@@ -1564,10 +1564,18 @@ ImageData* BaseRenderingContext2D::getImageData(
     return nullptr;
 
   if (sw < 0) {
+    if (!WTF::CheckAdd(sx, sw).IsValid<int>()) {
+      exception_state.ThrowRangeError("Out of memory at ImageData creation");
+      return nullptr;
+    }
     sx += sw;
     sw = -sw;
   }
   if (sh < 0) {
+    if (!WTF::CheckAdd(sy, sh).IsValid<int>()) {
+      exception_state.ThrowRangeError("Out of memory at ImageData creation");
+      return nullptr;
+    }
     sy += sh;
     sh = -sh;
   }

third_party/WebKit/Source/modules/canvas/canvas2d/CanvasRenderingContext2DAPITest.cpp

@@ -287,6 +287,24 @@ TEST_F(CanvasRenderingContext2DAPITest, GetImageDataTooBig) {
   EXPECT_EQ(kV8RangeError, exception_state.Code());
 }
 
+TEST_F(CanvasRenderingContext2DAPITest,
+       GetImageDataIntegerOverflowNegativeParams) {
+  CreateContext(kNonOpaque);
+  DummyExceptionStateForTesting exception_state;
+  ImageData* image_data = Context2d()->getImageData(
+      1, -2147483647, 1, -2147483647, exception_state);
+  EXPECT_EQ(nullptr, image_data);
+  EXPECT_TRUE(exception_state.HadException());
+  EXPECT_EQ(kV8RangeError, exception_state.Code());
+
+  exception_state.ClearException();
+  image_data = Context2d()->getImageData(-2147483647, 1, -2147483647, 1,
+                                         exception_state);
+  EXPECT_EQ(nullptr, image_data);
+  EXPECT_TRUE(exception_state.HadException());
+  EXPECT_EQ(kV8RangeError, exception_state.Code());
+}
+
 void ResetCanvasForAccessibilityRectTest(Document& document) {
   document.documentElement()->SetInnerHTMLFromString(R"HTML(
     <canvas id='canvas' style='position:absolute; top:0px; left:0px;