Fix a bug where an unsigned calculation goes negative and causes very large memcpy() call.

media/blink/multibuffer_reader.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/message_loop/message_loop.h"
 #include "media/blink/multibuffer_reader.h"
@@ skipping 88 matching lines @@
   int64_t p = pos_;
   int64_t bytes_read = 0;
   while (bytes_read < len) {
     if (i == data_map.end())
       break;
     if (i->first != block(p))
       break;
     if (i->second->end_of_stream())
       break;
     size_t offset = p & ((1LL << multibuffer_->block_size_shift()) - 1);
+    if (offset > static_cast<size_t>(i->second->data_size()))
+      break;
     size_t tocopy =
         std::min<size_t>(len - bytes_read, i->second->data_size() - offset);
     memcpy(data, i->second->data() + offset, tocopy);
     data += tocopy;
     bytes_read += tocopy;
     p += tocopy;
     ++i;
   }
   Seek(p);
   return bytes_read;
@@ skipping 116 matching lines @@
       multibuffer_->AddReader(preload_pos_, this);
     } else if (multibuffer_->Contains(preload_pos_ - 1)) {
       --preload_pos_;
       multibuffer_->AddReader(preload_pos_, this);
     }
   }
   CheckWait();
 }
 
 }  // namespace media