H264Parser: Check bounds for |expected_delta_per_pic_order_cnt_cycle|

media/filters/h264_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/h264_parser.h"
 
 #include <limits>
 #include <memory>
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/numerics/safe_math.h"
 #include "base/stl_util.h"
 #include "media/base/decrypt_config.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace media {
 
 bool H264SliceHeader::IsPSlice() const {
   return (slice_type % 5 == kPSlice);
 }
@@ skipping 918 matching lines @@
     sps->chroma_array_type = 0;
   else
     sps->chroma_array_type = sps->chroma_format_idc;
 
   READ_UE_OR_RETURN(&sps->log2_max_frame_num_minus4);
   TRUE_OR_RETURN(sps->log2_max_frame_num_minus4 < 13);
 
   READ_UE_OR_RETURN(&sps->pic_order_cnt_type);
   TRUE_OR_RETURN(sps->pic_order_cnt_type < 3);
 
-  sps->expected_delta_per_pic_order_cnt_cycle = 0;
   if (sps->pic_order_cnt_type == 0) {
     READ_UE_OR_RETURN(&sps->log2_max_pic_order_cnt_lsb_minus4);
     TRUE_OR_RETURN(sps->log2_max_pic_order_cnt_lsb_minus4 < 13);
+    sps->expected_delta_per_pic_order_cnt_cycle = 0;
   } else if (sps->pic_order_cnt_type == 1) {
     READ_BOOL_OR_RETURN(&sps->delta_pic_order_always_zero_flag);
     READ_SE_OR_RETURN(&sps->offset_for_non_ref_pic);
     READ_SE_OR_RETURN(&sps->offset_for_top_to_bottom_field);
     READ_UE_OR_RETURN(&sps->num_ref_frames_in_pic_order_cnt_cycle);
     TRUE_OR_RETURN(sps->num_ref_frames_in_pic_order_cnt_cycle < 255);
 
+    base::CheckedNumeric<int> offset_acc = 0;
     for (int i = 0; i < sps->num_ref_frames_in_pic_order_cnt_cycle; ++i) {
       READ_SE_OR_RETURN(&sps->offset_for_ref_frame[i]);
-      sps->expected_delta_per_pic_order_cnt_cycle +=
-          sps->offset_for_ref_frame[i];
+      offset_acc += sps->offset_for_ref_frame[i];
     }
+    if (!offset_acc.IsValid())
+      return kInvalidStream;
+    sps->expected_delta_per_pic_order_cnt_cycle = offset_acc.ValueOrDefault(0);
   }
 
   READ_UE_OR_RETURN(&sps->max_num_ref_frames);
   READ_BOOL_OR_RETURN(&sps->gaps_in_frame_num_value_allowed_flag);
 
   READ_UE_OR_RETURN(&sps->pic_width_in_mbs_minus1);
   READ_UE_OR_RETURN(&sps->pic_height_in_map_units_minus1);
 
   READ_BOOL_OR_RETURN(&sps->frame_mbs_only_flag);
   if (!sps->frame_mbs_only_flag)
@@ skipping 478 matching lines @@
 
     default:
       DVLOG(4) << "Unsupported SEI message";
       break;
   }
 
   return kOk;
 }
 
 }  // namespace media