Add static_casts when combining the padding length

components/gcm_driver/crypto/gcm_message_cryptographer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/gcm_driver/crypto/gcm_message_cryptographer.h"
 
 #include <algorithm>
 #include <sstream>
 
 #include "base/logging.h"
@@ skipping 152 matching lines @@
 
   // Records must be at least two octets in size (to hold the padding). Records
   // that are smaller, i.e. a single octet, are invalid.
   if (decrypted_record.size() < sizeof(uint16_t))
     return false;
 
   // Records contain a two-byte, big-endian padding length followed by zero to
   // 65535 bytes of padding. Padding bytes must be zero but, since AES-GCM
   // authenticates the plaintext, checking and removing padding need not be done
   // in constant-time.
-  uint16_t padding_length = (decrypted_record[0] << 8) | decrypted_record[1];
+  uint16_t padding_length = (static_cast<uint8_t>(decrypted_record[0]) << 8) |
+                            static_cast<uint8_t>(decrypted_record[1]);
   decrypted_record.remove_prefix(sizeof(uint16_t));
 
   if (padding_length > decrypted_record.size()) {
     return false;
   }
 
   for (size_t i = 0; i < padding_length; ++i) {
     if (decrypted_record[i] != 0)
       return false;
   }
@@ skipping 44 matching lines @@
                     0   /* subkey_secret_bytes_to_generate */);
 
   // draft-thomson-http-encryption defines that the result should be XOR'ed with
   // the record's sequence number, however, Web Push encryption is limited to a
   // single record per draft-ietf-webpush-encryption.
 
   return hkdf.client_write_key().as_string();
 }
 
 }  // namespace gcm