[CP-stable]Check for overflow when computing the pixel buffer size for an animated PNG frame (flutter#185621)

### Issue Link:
What is the link to the issue this cherry-pick is addressing?

http://b/489180577

### Impact Description:

Reliability improvement in the animated PNG decoder

### Changelog Description:

Fixes a potential integer overflow that could happen when handling some animated PNG files.

### Workaround:
Is there a workaround for this issue?

No

### Risk:
What is the risk level of this cherry-pick?

### Test Coverage:
Are you confident that your fix is well-tested by automated tests?

### Validation Steps:
What are the steps to validate that this fix works?

See http://b/489180577

Author: flutteractionsbot

engine/src/flutter/fml/BUILD.gn

@@ -67,6 +67,8 @@ source_set("fml") {
     "process.h",
     "raster_thread_merger.cc",
     "raster_thread_merger.h",
+    "safe_math.cc",
+    "safe_math.h",
     "shared_thread_merger.cc",
     "shared_thread_merger.h",
     "status.h",
@@ -111,7 +113,7 @@ source_set("fml") {
     ":string_conversion",
   ]
 
-  deps = []
+  deps = [ "//third_party/abseil-cpp/absl/numeric:int128" ]
   if (target_os != "wasm") {
     deps += [ "//flutter/third_party/icu" ]
 
@@ -350,6 +352,7 @@ if (enable_unittests) {
       "message_loop_unittests.cc",
       "paths_unittests.cc",
       "raster_thread_merger_unittests.cc",
+      "safe_math_unittests.cc",
       "string_conversion_unittests.cc",
       "synchronization/count_down_latch_unittests.cc",
       "synchronization/semaphore_unittest.cc",

engine/src/flutter/fml/safe_math.cc

@@ -0,0 +1,41 @@
+// Copyright 2013 The Flutter Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits>
+
+#include "flutter/fml/safe_math.h"
+#include "third_party/abseil-cpp/absl/numeric/int128.h"
+
+namespace fml {
+
+size_t SafeMath::mul(size_t x, size_t y) {
+  return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y);
+}
+
+uint32_t SafeMath::mul32(uint32_t x, uint32_t y) {
+  uint64_t big_x = x;
+  uint64_t big_y = y;
+  uint64_t result = big_x * big_y;
+  if (result >> 32) {
+    overflow_detected_ = true;
+  }
+  return static_cast<uint32_t>(result);
+}
+
+uint64_t SafeMath::mul64(uint64_t x, uint64_t y) {
+  if (x <= std::numeric_limits<uint32_t>::max() &&
+      y <= std::numeric_limits<uint32_t>::max()) {
+    return x * y;
+  }
+
+  absl::uint128 big_x = x;
+  absl::uint128 big_y = y;
+  absl::uint128 result = big_x * big_y;
+  if (absl::Uint128High64(result)) {
+    overflow_detected_ = true;
+  }
+  return absl::Uint128Low64(result);
+}
+
+}  // namespace fml

engine/src/flutter/fml/safe_math.h

@@ -0,0 +1,30 @@
+// Copyright 2013 The Flutter Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef FLUTTER_FML_SAFE_MATH_H_
+#define FLUTTER_FML_SAFE_MATH_H_
+
+#include <cstddef>
+#include <cstdint>
+
+namespace fml {
+
+// Math operations that check for overflow.
+// Based on Skia's SkSafeMath.
+class SafeMath {
+ public:
+  bool overflow_detected() const { return overflow_detected_; }
+
+  size_t mul(size_t x, size_t y);
+
+ private:
+  uint32_t mul32(uint32_t x, uint32_t y);
+  uint64_t mul64(uint64_t x, uint64_t y);
+
+  bool overflow_detected_ = false;
+};
+
+}  // namespace fml
+
+#endif  // FLUTTER_FML_SAFE_MATH_H_

engine/src/flutter/fml/safe_math_unittests.cc

@@ -0,0 +1,39 @@
+// Copyright 2013 The Flutter Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits>
+
+#include "flutter/fml/safe_math.h"
+#include "gtest/gtest.h"
+
+namespace flutter {
+namespace testing {
+
+TEST(SafeMathTest, MultiplySizeT) {
+  // Multiplication with no overflow.
+  fml::SafeMath safe1;
+  EXPECT_EQ(safe1.mul(1000, 2000), static_cast<size_t>(2000000));
+  EXPECT_FALSE(safe1.overflow_detected());
+
+  // Overflow detection when multiplying size_t values at or near the maximum.
+  fml::SafeMath safe2;
+  safe2.mul(std::numeric_limits<size_t>::max(),
+            std::numeric_limits<size_t>::max());
+  EXPECT_TRUE(safe2.overflow_detected());
+
+  fml::SafeMath safe3;
+  safe3.mul(std::numeric_limits<size_t>::max() >> 2, 5);
+  EXPECT_TRUE(safe3.overflow_detected());
+
+  // Overflow detection for a result that slightly exceeds the range of a
+  // uint64_t.
+  if (sizeof(size_t) == sizeof(uint64_t)) {
+    fml::SafeMath safe4;
+    safe4.mul(static_cast<size_t>(1ULL << 32), static_cast<size_t>(1ULL << 32));
+    EXPECT_TRUE(safe4.overflow_detected());
+  }
+}
+
+}  // namespace testing
+}  // namespace flutter

engine/src/flutter/lib/ui/painting/image_generator_apng.cc

@@ -7,6 +7,7 @@
 #include <cstring>
 
 #include "flutter/fml/logging.h"
+#include "flutter/fml/safe_math.h"
 #include "third_party/skia/include/codec/SkCodec.h"
 #include "third_party/skia/include/codec/SkCodecAnimation.h"
 #include "third_party/skia/include/core/SkAlphaType.h"
@@ -91,10 +92,26 @@ bool APNGImageGenerator::GetPixels(const SkImageInfo& info,
 
   APNGImage& frame = images_[image_index];
   SkImageInfo frame_info = frame.codec->getInfo();
-  auto frame_row_bytes = frame_info.bytesPerPixel() * frame_info.width();
+
+  fml::SafeMath safe;
+  size_t frame_row_bytes =
+      safe.mul(frame_info.bytesPerPixel(), frame_info.width());
+  if (safe.overflow_detected()) {
+    FML_DLOG(ERROR) << "Failed to decode image at index " << image_index
+                    << " (frame index: " << frame_index
+                    << ") of APNG due to frame row bytes overflow.";
+    return false;
+  }
 
   if (frame.pixels.empty()) {
-    frame.pixels.resize(frame_row_bytes * frame_info.height());
+    size_t pixels_bytes = safe.mul(frame_row_bytes, frame_info.height());
+    if (safe.overflow_detected()) {
+      FML_DLOG(ERROR) << "Failed to decode image at index " << image_index
+                      << " (frame index: " << frame_index
+                      << ") of APNG due to pixel buffer size overflow.";
+      return false;
+    }
+    frame.pixels.resize(pixels_bytes);
     SkCodec::Result result = frame.codec->getPixels(
         frame.codec->getInfo(), frame.pixels.data(), frame_row_bytes);
     if (result != SkCodec::kSuccess) {