Fix possible timestamp overflow in the MP4 stream parser.

media/formats/mp4/track_run_iterator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/track_run_iterator.h"
 
 #include <algorithm>
 
 #include "media/base/buffers.h"
 #include "media/base/stream_parser_buffer.h"
@@ skipping 39 matching lines @@
       start_dts(-1),
       sample_start_offset(-1),
       is_audio(false),
       aux_info_start_offset(-1),
       aux_info_default_size(-1),
       aux_info_total_size(-1) {
 }
 TrackRunInfo::~TrackRunInfo() {}
 
 TimeDelta TimeDeltaFromRational(int64 numer, int64 denom) {
-  DCHECK_LT((numer > 0 ? numer : -numer),
-            kint64max / base::Time::kMicrosecondsPerSecond);
-  return TimeDelta::FromMicroseconds(
-        base::Time::kMicrosecondsPerSecond * numer / denom);
+  // To avoid overflow, split the following calculation:

[DaleCurtis, 2014/02/22 01:41:20]

Why not TimeDelta::FromMicroseconds((static_cast<double>(numer) / denom) *
base::Time::kMicrosecondsPerSecond) ?

[damienv1, 2014/02/22 01:53:01]

I was wondering if in some cases you can loose some precision (mantissa for a
double is coded on 52 bits).
I went for the safe solution (which gives exactly the same result as the
previous implementation except that it supports more cases without overflowing).

[acolwell GONE FROM CHROMIUM, 2014/02/22 02:00:35]

The conversion to double can lose precision if |numer| is > 52-bits and |denom|
is a small number like 2.

+  // (numer * base::Time::kMicrosecondsPerSecond) / denom
+  // into:
+  //  (numer / denom) * base::Time::kMicrosecondsPerSecond +
+  // ((numer % denom) * base::Time::kMicrosecondsPerSecond) / denom
+  int64 a = numer / denom;
+  DCHECK_LE((a > 0 ? a : -a), kint64max / base::Time::kMicrosecondsPerSecond);
+  int64 timea_in_us = a * base::Time::kMicrosecondsPerSecond;
+
+  int64 b = numer % denom;
+  DCHECK_LE((b > 0 ? b : -b), kint64max / base::Time::kMicrosecondsPerSecond);
+  int64 timeb_in_us = (b * base::Time::kMicrosecondsPerSecond) / denom;
+
+  DCHECK((timeb_in_us < 0) || (timea_in_us <= kint64max - timeb_in_us));
+  DCHECK((timeb_in_us > 0) || (timea_in_us >= kint64min - timeb_in_us));
+  return TimeDelta::FromMicroseconds(timea_in_us + timeb_in_us);
 }
 
 TrackRunIterator::TrackRunIterator(const Movie* moov,
                                    const LogCB& log_cb)
     : moov_(moov), log_cb_(log_cb), sample_offset_(0) {
   CHECK(moov);
 }
 
 TrackRunIterator::~TrackRunIterator() {}
 
@@ skipping 384 matching lines @@
   const std::vector<uint8>& kid = track_encryption().default_kid;
   return scoped_ptr<DecryptConfig>(new DecryptConfig(
       std::string(reinterpret_cast<const char*>(&kid[0]), kid.size()),
       std::string(reinterpret_cast<const char*>(cenc_info.iv),
                   arraysize(cenc_info.iv)),
       cenc_info.subsamples));
 }
 
 }  // namespace mp4
 }  // namespace media