diff --git a/src/browser/tests/image_data.html b/src/browser/tests/image_data.html
index ccaef668..3cf3282e 100644
--- a/src/browser/tests/image_data.html
+++ b/src/browser/tests/image_data.html
@@ -59,10 +59,6 @@
}
-
+
+
diff --git a/src/browser/webapi/ImageData.zig b/src/browser/webapi/ImageData.zig
index 05fcae6c..c9ced5f1 100644
--- a/src/browser/webapi/ImageData.zig
+++ b/src/browser/webapi/ImageData.zig
@@ -58,7 +58,10 @@ pub fn constructor(
maybe_settings: ?ConstructorSettings,
page: *Page,
) !*ImageData {
- if (width == 0 or height == 0) {
+ // Though arguments are unsigned long, these are capped to max. i32 on Chrome.
+ // https://github.com/chromium/chromium/blob/main/third_party/blink/renderer/core/html/canvas/image_data.cc#L61
+ const max_i32 = std.math.maxInt(i32);
+ if (width == 0 or width > max_i32 or height == 0 or height > max_i32) {
return error.IndexSizeError;
}
@@ -70,7 +73,11 @@ pub fn constructor(
return error.TypeError;
}
- const size = width * height * 4;
+ var size, var overflown = @mulWithOverflow(width, height);
+ if (overflown == 1) return error.IndexSizeError;
+ size, overflown = @mulWithOverflow(size, 4);
+ if (overflown == 1) return error.IndexSizeError;
+
return page._factory.create(ImageData{
._width = width,
._height = height,