Check shared memory size before allocating it.

content/browser/renderer_host/media/audio_input_renderer_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/audio_input_renderer_host.h"
 
 #include "base/bind.h"
 #include "base/memory/shared_memory.h"
 #include "base/metrics/histogram.h"
+#include "base/numerics/safe_math.h"
 #include "base/process/process.h"
 #include "base/strings/stringprintf.h"
 #include "content/browser/media/capture/web_contents_audio_input_stream.h"
 #include "content/browser/media/capture/web_contents_capture_util.h"
 #include "content/browser/media/media_internals.h"
 #include "content/browser/renderer_host/media/audio_input_device_manager.h"
 #include "content/browser/renderer_host/media/audio_input_sync_writer.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "media/audio/audio_manager_base.h"
 
@@ skipping 232 matching lines @@
 
   // Create a new AudioEntry structure.
   scoped_ptr<AudioEntry> entry(new AudioEntry());
 
   const uint32 segment_size = (sizeof(media::AudioInputBufferParameters) +
                                audio_params.GetBytesPerBuffer());
   entry->shared_memory_segment_count = config.shared_memory_count;
 
   // Create the shared memory and share it with the renderer process
   // using a new SyncWriter object.
-  if (!entry->shared_memory.CreateAndMapAnonymous(
-      segment_size * entry->shared_memory_segment_count)) {
+  base::CheckedNumeric<uint32> size = segment_size;
+  size *= entry->shared_memory_segment_count;
+  if (!size.IsValid() ||
+      !entry->shared_memory.CreateAndMapAnonymous(size.ValueOrDie())) {
     // If creation of shared memory failed then send an error message.
     SendErrorMessage(stream_id, SHARED_MEMORY_CREATE_FAILED);
     return;
   }
 
   scoped_ptr<AudioInputSyncWriter> writer(
       new AudioInputSyncWriter(&entry->shared_memory,
                                entry->shared_memory_segment_count));
 
   if (!writer->Init()) {
@@ skipping 149 matching lines @@
   // TODO(hclam): Implement a faster look up method.
   for (AudioEntryMap::iterator i = audio_entries_.begin();
        i != audio_entries_.end(); ++i) {
     if (controller == i->second->controller.get())
       return i->second;
   }
   return NULL;
 }
 
 }  // namespace content