1 files changed, 5 insertions, 3 deletions
diff --git a/gfx/skia/skia/include/private/SkTDArray.h b/gfx/skia/skia/include/private/SkTDArray.h
index f71d35700..a46a05e9d 100644
--- a/gfx/skia/skia/include/private/SkTDArray.h
+++ b/gfx/skia/skia/include/private/SkTDArray.h
@@ -21,7 +21,7 @@ public:
         fReserve = fCount = 0;
         fArray = NULL;
         if (count) {
-            fArray = (T*)sk_malloc_throw(count * sizeof(T));
+            fArray = (T*)sk_malloc_throw(count, sizeof(T));
             memcpy(fArray, src, sizeof(T) * count);
             fReserve = fCount = count;
         }
@@ -346,7 +346,7 @@ public:
 
     void shrinkToFit() {
         fReserve = fCount;
-        fArray = (T*)sk_realloc_throw(fArray, fReserve * sizeof(T));
+        fArray = (T*)sk_realloc_throw(fArray, fReserve, sizeof(T));
     }
 
 private:
@@ -359,6 +359,7 @@ private:
      *  This is the same as calling setCount(count() + delta).
      */
     void adjustCount(int delta) {
+        SkASSERT_RELEASE(fCount <= std::numeric_limits<int>::max() - delta);
         this->setCount(fCount + delta);
     }
 
@@ -372,9 +373,10 @@ private:
      */
     void resizeStorageToAtLeast(int count) {
         SkASSERT(count > fReserve);
+        SkASSERT_RELEASE(count <= std::numeric_limits<int>::max() - std::numeric_limits<int>::max() / 5 - 4);
         fReserve = count + 4;
         fReserve += fReserve / 4;
-        fArray = (T*)sk_realloc_throw(fArray, fReserve * sizeof(T));
+        fArray = (T*)sk_realloc_throw(fArray, fReserve, sizeof(T));
     }
 };