Avoid integer overflow errors when parsing Exp-Golomb codes

media/filters/h264_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "media/filters/h264_parser.h"
+
+#include <limits>
+
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
-
 #include "media/base/decrypt_config.h"
-#include "media/filters/h264_parser.h"
 
 namespace media {
 
 bool H264SliceHeader::IsPSlice() const {
   return (slice_type % 5 == kPSlice);
 }
 
 bool H264SliceHeader::IsBSlice() const {
   return (slice_type % 5 == kBSlice);
 }
@@ skipping 289 matching lines @@
   // Count the number of contiguous zero bits.
   do {
     READ_BITS_OR_RETURN(1, &bit);
     num_bits++;
   } while (bit == 0);
 
   if (num_bits > 31)
     return kInvalidStream;
 
   // Calculate exp-Golomb code value of size num_bits.
-  *val = (1 << num_bits) - 1;
+  // Special case for |num_bits| == 31 to avoid integer overflow. The only
+  // valid representation as an int is 2^31 - 1, so the remaining bits must
+  // be 0 or else the number is too large.
+  *val = (1u << num_bits) - 1;

[sandersd (OOO until July 31), 2016/04/07 20:48:09]

Both ones should be 1u.

[jrummell, 2016/04/07 21:13:59]

Done.

+
+  if (num_bits == 31) {
+    READ_BITS_OR_RETURN(num_bits, &rest);
+    return (rest == 0) ? kOk : kInvalidStream;
+  }
 
   if (num_bits > 0) {
     READ_BITS_OR_RETURN(num_bits, &rest);
     *val += rest;
   }
 
   return kOk;
 }
 
 H264Parser::Result H264Parser::ReadSE(int* val) {
@@ skipping 1006 matching lines @@
 
     default:
       DVLOG(4) << "Unsupported SEI message";
       break;
   }
 
   return kOk;
 }
 
 }  // namespace media