Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1048)

Unified Diff: media/blink/multibuffer_reader.cc

Issue 1729223003: Fix a bug where an unsigned calculation goes negative and causes very large memcpy() call. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: compile fix Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « media/blink/multibuffer_data_source_unittest.cc ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: media/blink/multibuffer_reader.cc
diff --git a/media/blink/multibuffer_reader.cc b/media/blink/multibuffer_reader.cc
index b9d07529efc61c01fd6dcbee7654b7276c6afd68..2a695ff6797f53078b417a48d5e221965dd35b95 100644
--- a/media/blink/multibuffer_reader.cc
+++ b/media/blink/multibuffer_reader.cc
@@ -106,6 +106,8 @@ int64_t MultiBufferReader::TryRead(uint8_t* data, int64_t len) {
if (i->second->end_of_stream())
break;
size_t offset = p & ((1LL << multibuffer_->block_size_shift()) - 1);
+ if (offset > static_cast<size_t>(i->second->data_size()))
+ break;
size_t tocopy =
std::min<size_t>(len - bytes_read, i->second->data_size() - offset);
memcpy(data, i->second->data() + offset, tocopy);
« no previous file with comments | « media/blink/multibuffer_data_source_unittest.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698