commit 4daf403ca4dfcfbce6a40574bf3da6b7fec9342f
author oshima <oshima@chromium.org> Fri Dec 04 04:44:55 2015
committer Commit bot <commit-bot@chromium.org> Fri Dec 04 04:45:50 2015
tree 54e1d09d9312edc3229c0ec529dd1b8a6684fbe1
parent 49ae7c7da53213681a835f53380f275af4c0a4e4

Fix an overflow in WebCursor.

I also added log message just in case a user has an issue with erroneous but unmalicious web cursor.

BUG=565023

Review URL: https://codereview.chromium.org/1498903003

Cr-Commit-Position: refs/heads/master@{#363136}

content/common/cursors/webcursor.cc

diff --git a/content/common/cursors/webcursor.cc b/content/common/cursors/webcursor.cc
index faa6d703..b2dfcdf 100644
--- a/content/common/cursors/webcursor.cc
+++ b/content/common/cursors/webcursor.cc
@@ -112,8 +112,12 @@
     if (size_x > 0 && size_y > 0) {
       // The * 4 is because the expected format is an array of RGBA pixel
       // values.
-      if (size_x * size_y * 4 > data_len)
+      if (size_x * size_y * 4 != data_len) {
+        LOG(WARNING) << "WebCursor's data length and image size mismatch: "
+                     << size_x << "x" << size_y << "x4 != "
+                     << data_len;
         return false;
+      }
 
       hotspot_.set_x(hotspot_x);
       hotspot_.set_y(hotspot_y);