Fix a bug where an unsigned calculation goes negative and causes very large memcpy() call.

media/blink/multibuffer_data_source_unittest.cc

Index: media/blink/multibuffer_data_source_unittest.cc
diff --git a/media/blink/multibuffer_data_source_unittest.cc b/media/blink/multibuffer_data_source_unittest.cc
index ead1269624c851777c2cc99027b23bbcac93f804..ba90f1c62fbdef18c2b33f4a9c12f6b2fb63ccc4 100644
--- a/media/blink/multibuffer_data_source_unittest.cc
+++ b/media/blink/multibuffer_data_source_unittest.cc
@@ -1215,4 +1215,38 @@ TEST_F(MultibufferDataSourceTest,
   EXPECT_FALSE(active_loader_allownull());
 }
 
+TEST_F(MultibufferDataSourceTest, SeekPastEOF) {
+  GURL gurl(kHttpUrl);
+  data_source_.reset(new MockMultibufferDataSource(
+      gurl, message_loop_.task_runner(), url_index_,
+      view_->mainFrame()->toWebLocalFrame(), &host_));
+  data_source_->SetPreload(preload_);
+
+  response_generator_.reset(new TestResponseGenerator(gurl, kDataSize + 1));
+  EXPECT_CALL(*this, OnInitialize(true));
+  data_source_->Initialize(base::Bind(&MultibufferDataSourceTest::OnInitialize,
+                                      base::Unretained(this)));
+  message_loop_.RunUntilIdle();
+
+  // Not really loading until after OnInitialize is called.
+  EXPECT_EQ(data_source_->downloading(), false);
+
+  EXPECT_CALL(host_, SetTotalBytes(response_generator_->content_length()));
+  Respond(response_generator_->Generate206(0));
+  EXPECT_CALL(host_, AddBufferedByteRange(0, kDataSize));
+  ReceiveData(kDataSize);
+
+  // Read a bit from the beginning.
+  EXPECT_CALL(*this, ReadCallback(kDataSize));
+  ReadAt(0);
+
+  ReceiveData(1);
+  EXPECT_CALL(host_, AddBufferedByteRange(0, kDataSize * 3));
+  FinishLoading();
+  EXPECT_CALL(*this, ReadCallback(0));
+
+  ReadAt(kDataSize + 5, kDataSize * 2);
+  Stop();
+}
+
 }  // namespace media