Attempt to fix a crash in the H.264 decoder on Windows in the GPU process.

content/common/gpu/media/dxva_video_decode_accelerator_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/media/dxva_video_decode_accelerator_win.h"
 
 #if !defined(OS_WIN)
 #error This file should only be built on Windows.
 #endif   // !defined(OS_WIN)
 
@@ skipping 162 matching lines @@
 
 static IMFSample* CreateEmptySample() {
   base::win::ScopedComPtr<IMFSample> sample;
   HRESULT hr = MFCreateSample(sample.Receive());
   RETURN_ON_HR_FAILURE(hr, "MFCreateSample failed", NULL);
   return sample.Detach();
 }
 
 // Creates a Media Foundation sample with one buffer of length |buffer_length|
 // on a |align|-byte boundary. Alignment must be a perfect power of 2 or 0.
-static IMFSample* CreateEmptySampleWithBuffer(int buffer_length, int align) {
-  CHECK_GT(buffer_length, 0);
+static IMFSample* CreateEmptySampleWithBuffer(uint32_t buffer_length,
+                                              int align) {
+  CHECK_GT(buffer_length, 0U);
 
   base::win::ScopedComPtr<IMFSample> sample;
   sample.Attach(CreateEmptySample());
 
   base::win::ScopedComPtr<IMFMediaBuffer> buffer;
   HRESULT hr = E_FAIL;
   if (align == 0) {
     // Note that MFCreateMemoryBuffer is same as MFCreateAlignedMemoryBuffer
     // with the align argument being 0.
     hr = MFCreateMemoryBuffer(buffer_length, buffer.Receive());
@@ skipping 10 matching lines @@
   buffer->SetCurrentLength(0);
   return sample.Detach();
 }
 
 // Creates a Media Foundation sample with one buffer containing a copy of the
 // given Annex B stream data.
 // If duration and sample time are not known, provide 0.
 // |min_size| specifies the minimum size of the buffer (might be required by
 // the decoder for input). If no alignment is required, provide 0.
 static IMFSample* CreateInputSample(const uint8_t* stream,
-                                    int size,
-                                    int min_size,
+                                    uint32_t size,
+                                    uint32_t min_size,
                                     int alignment) {
   CHECK(stream);
-  CHECK_GT(size, 0);
+  CHECK_GT(size, 0U);
   base::win::ScopedComPtr<IMFSample> sample;
   sample.Attach(CreateEmptySampleWithBuffer(std::max(min_size, size),
                                             alignment));
   RETURN_ON_FAILURE(sample.get(), "Failed to create empty sample", NULL);
 
   base::win::ScopedComPtr<IMFMediaBuffer> buffer;
   HRESULT hr = sample->GetBufferByIndex(0, buffer.Receive());
   RETURN_ON_HR_FAILURE(hr, "Failed to get buffer from sample", NULL);
 
   DWORD max_length = 0;
   DWORD current_length = 0;
   uint8_t* destination = NULL;
   hr = buffer->Lock(&destination, &max_length, &current_length);
   RETURN_ON_HR_FAILURE(hr, "Failed to lock buffer", NULL);
 
   CHECK_EQ(current_length, 0u);
-  CHECK_GE(static_cast<int>(max_length), size);
+  CHECK_GE(max_length, size);
   memcpy(destination, stream, size);
 
+  hr = buffer->SetCurrentLength(size);
+  RETURN_ON_HR_FAILURE(hr, "Failed to set buffer length", NULL);
+
   hr = buffer->Unlock();
   RETURN_ON_HR_FAILURE(hr, "Failed to unlock buffer", NULL);
 
-  hr = buffer->SetCurrentLength(size);
-  RETURN_ON_HR_FAILURE(hr, "Failed to set buffer length", NULL);
-
   return sample.Detach();
 }
 
 static IMFSample* CreateSampleFromInputBuffer(
     const media::BitstreamBuffer& bitstream_buffer,
-    DWORD stream_size,
+    uint32_t stream_size,
     DWORD alignment) {
   base::SharedMemory shm(bitstream_buffer.handle(), true);
   RETURN_ON_FAILURE(shm.Map(bitstream_buffer.size()),
                     "Failed in base::SharedMemory::Map", NULL);
 
   return CreateInputSample(reinterpret_cast<const uint8_t*>(shm.memory()),
-                           bitstream_buffer.size(), stream_size, alignment);
+                           bitstream_buffer.size(),
+                           std::min<uint32_t>(bitstream_buffer.size(),
+                                              stream_size),
+                           alignment);
 }
 
 // Helper function to create a COM object instance from a DLL. The alternative
 // is to use the CoCreateInstance API which requires the COM apartment to be
 // initialized which is not the case on the GPU main thread. We want to avoid
 // initializing COM as it may have sideeffects.
 HRESULT CreateCOMObjectFromDll(HMODULE dll, const CLSID& clsid, const IID& iid,
                                void** object) {
   if (!dll || !object)
     return E_INVALIDARG;
@@ skipping 2109 matching lines @@
       }
       RETURN_ON_HR_FAILURE(hr, "Failed to set output type", false);
       return true;
     }
     media_type.Release();
   }
   return false;
 }
 
 }  // namespace content