Avoid integer overflow errors when parsing Exp-Golomb codes

media/filters/h264_parser.cc

Index: media/filters/h264_parser.cc
diff --git a/media/filters/h264_parser.cc b/media/filters/h264_parser.cc
index d751de77fcaa06ebdabee2ca130385189b2fc80b..4aa511ffa9f4909c601b37fb9ccb02ad7f888f58 100644
--- a/media/filters/h264_parser.cc
+++ b/media/filters/h264_parser.cc
@@ -2,13 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "media/filters/h264_parser.h"
+
+#include <limits>
+
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
-
 #include "media/base/decrypt_config.h"
-#include "media/filters/h264_parser.h"
 
 namespace media {
 
@@ -318,8 +320,14 @@ H264Parser::Result H264Parser::ReadUE(int* val) {
     return kInvalidStream;
 
   // Calculate exp-Golomb code value of size num_bits.
-  *val = (1 << num_bits) - 1;
+  // Special case for |num_bits| == 31 to avoid integer overflow.
+  if (num_bits == 31) {

[sandersd (OOO until July 31), 2016/04/07 01:26:09]

Add a comment to the first line explaining that we are limiting to &rest == 0,
so the value must be 2 ^ 31 - 1.

[jrummell, 2016/04/07 01:49:19]

Done.

+    *val = std::numeric_limits<int>::max();

[jrummell, 2016/04/07 01:09:32]

Since we're checking for 2^31-1 explicitly, I debated using 0x7fffffff or
numeric_limits<int32_t> instead. Can int be larger than 32 bits on some
platforms?

[sandersd (OOO until July 31), 2016/04/07 01:26:09]

What we should actually be doing is rewriting H264Parser to use int32_t. There
is no reason for this code to vary by platform (and in fact this code assumes
that int == int32_t).

A static assert here about the size of an int, along with a TODO, would be a
good start.

[jrummell, 2016/04/07 01:49:19]

Done.

+    READ_BITS_OR_RETURN(num_bits, &rest);
+    return (rest == 0) ? kOk : kInvalidStream;
+  }
 
+  *val = (1 << num_bits) - 1;
   if (num_bits > 0) {
     READ_BITS_OR_RETURN(num_bits, &rest);
     *val += rest;