guard against masks that are too big to blur

Check that the calculation of the tmp buffer size will not
overflow an int.

Bug=skia:27758

Change-Id: Ie1def7a4bf81f04e3231bfc1bd590f24ba3f5f7f
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/365487
Reviewed-by: Michael Ludwig <michaelludwig@google.com>
Commit-Queue: Herb Derby <herb@google.com>

src/core/SkMaskBlurFilter.cpp

@@ -992,6 +992,10 @@ SkIPoint SkMaskBlurFilter::blur(const SkMask& src, SkMask* dst) const {
     int tmpW = srcH,
         tmpH = dstW;
 
+    // Make sure not to overflow the multiply for the tmp buffer size.
+    if (tmpH > std::numeric_limits<int>::max() / tmpW) {
+        return {0, 0};
+    }
     auto tmp = alloc.makeArrayDefault<uint8_t>(tmpW * tmpH);
 
     // Blur horizontally, and transpose.