Index: content/common/gpu/media/media_messages.cc |
diff --git a/content/common/gpu/media/media_messages.cc b/content/common/gpu/media/media_messages.cc |
index 88364d9465eeb6029d1d6ee58151f4ed8a190fca..6b9648d80d89162b2407b09a432d27d4182034f8 100644 |
--- a/content/common/gpu/media/media_messages.cc |
+++ b/content/common/gpu/media/media_messages.cc |
@@ -16,6 +16,8 @@ void ParamTraits<media::BitstreamBuffer>::Write(base::Pickle* m, |
const param_type& p) { |
WriteParam(m, p.id()); |
WriteParam(m, static_cast<uint64_t>(p.size())); |
+ DCHECK_GE(p.offset(), 0); |
+ WriteParam(m, static_cast<uint64_t>(p.offset())); |
WriteParam(m, p.presentation_timestamp()); |
WriteParam(m, p.key_id()); |
if (!p.key_id().empty()) { |
@@ -30,7 +32,9 @@ bool ParamTraits<media::BitstreamBuffer>::Read(const base::Pickle* m, |
param_type* r) { |
DCHECK(r); |
uint64_t size = 0; |
+ uint64_t offset = 0; |
if (!(ReadParam(m, iter, &r->id_) && ReadParam(m, iter, &size) && |
+ ReadParam(m, iter, &offset) && |
ReadParam(m, iter, &r->presentation_timestamp_) && |
ReadParam(m, iter, &r->key_id_))) |
return false; |
@@ -42,6 +46,13 @@ bool ParamTraits<media::BitstreamBuffer>::Read(const base::Pickle* m, |
} |
r->size_ = checked_size.ValueOrDie(); |
+ base::CheckedNumeric<off_t> checked_offset(offset); |
+ if (!checked_offset.IsValid()) { |
+ DLOG(ERROR) << "Invalid offset: " << offset; |
+ return false; |
+ } |
+ r->offset_ = checked_offset.ValueOrDie(); |
+ |
if (!r->key_id_.empty()) { |
if (!(ReadParam(m, iter, &r->iv_) && ReadParam(m, iter, &r->subsamples_))) |
return false; |