Check frame coded size in H264 parsers to avoid integer overflows

media/formats/mp2t/es_parser_h264.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp2t/es_parser_h264.h"
 
+#include <limits>
+
 #include "base/logging.h"
 #include "base/numerics/safe_conversions.h"
 #include "media/base/encryption_scheme.h"
 #include "media/base/media_util.h"
 #include "media/base/stream_parser_buffer.h"
 #include "media/base/timestamp_constants.h"
 #include "media/base/video_frame.h"
 #include "media/filters/h264_parser.h"
 #include "media/formats/common/offset_byte_queue.h"
 #include "media/formats/mp2t/mp2t_common.h"
@@ skipping 273 matching lines @@
 }
 
 bool EsParserH264::UpdateVideoDecoderConfig(const H264SPS* sps,
                                             const EncryptionScheme& scheme) {
   // Set the SAR to 1 when not specified in the H264 stream.
   int sar_width = (sps->sar_width == 0) ? 1 : sps->sar_width;
   int sar_height = (sps->sar_height == 0) ? 1 : sps->sar_height;
 
   // TODO(damienv): a MAP unit can be either 16 or 32 pixels.
   // although it's 16 pixels for progressive non MBAFF frames.
-  gfx::Size coded_size((sps->pic_width_in_mbs_minus1 + 1) * 16,
-                       (sps->pic_height_in_map_units_minus1 + 1) * 16);
+  int width_mb = sps->pic_width_in_mbs_minus1 + 1;
+  int height_mb = sps->pic_height_in_map_units_minus1 + 1;
+  if (width_mb > std::numeric_limits<int>::max() / 16 ||
+      height_mb > std::numeric_limits<int>::max() / 16) {
+    DVLOG(1) << "Picture size is too big: width_mb=" << width_mb
+             << " height_mb=" << height_mb;
+    return false;
+  }
+
+  gfx::Size coded_size(16 * width_mb, 16 * height_mb);
   gfx::Rect visible_rect(
       sps->frame_crop_left_offset,
       sps->frame_crop_top_offset,
       (coded_size.width() - sps->frame_crop_right_offset) -
       sps->frame_crop_left_offset,
       (coded_size.height() - sps->frame_crop_bottom_offset) -
       sps->frame_crop_top_offset);
   if (visible_rect.width() <= 0 || visible_rect.height() <= 0)
     return false;
   gfx::Size natural_size(
@@ skipping 18 matching lines @@
              << " height=" << sps->sar_height;
     last_video_decoder_config_ = video_decoder_config;
     es_adapter_.OnConfigChanged(video_decoder_config);
   }
 
   return true;
 }
 
 }  // namespace mp2t
 }  // namespace media