Change type of sample_count_sum from int to uint64_t to fix possible overflow

media/formats/mp4/track_run_iterator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/track_run_iterator.h"
 
 #include <algorithm>
 #include <iomanip>
 #include <limits>
 #include <memory>
@@ skipping 264 matching lines @@
       continue;
     }
     size_t desc_idx = traf.header.sample_description_index;
     if (!desc_idx) desc_idx = trex->default_sample_description_index;
     RCHECK(desc_idx > 0);  // Descriptions are one-indexed in the file
     desc_idx -= 1;
 
     const std::vector<uint8_t>& sample_encryption_data =
         traf.sample_encryption.sample_encryption_data;
     std::unique_ptr<BufferReader> sample_encryption_reader;
-    uint32_t sample_encrytion_entries_count = 0;
+    uint32_t sample_encryption_entries_count = 0;
     if (!sample_encryption_data.empty()) {
       sample_encryption_reader.reset(new BufferReader(
           sample_encryption_data.data(), sample_encryption_data.size()));
-      RCHECK(sample_encryption_reader->Read4(&sample_encrytion_entries_count));
+      RCHECK(sample_encryption_reader->Read4(&sample_encryption_entries_count));
     }
 
     // Process edit list to remove CTS offset introduced in the presence of
     // B-frames (those that contain a single edit with a nonnegative media
     // time). Other uses of edit lists are not supported, as they are
     // both uncommon and better served by higher-level protocols.
     int64_t edit_list_offset = 0;
     const std::vector<EditListEntry>& edits = trak->edit.list.edits;
     if (!edits.empty()) {
       if (edits.size() > 1)
         DVLOG(1) << "Multi-entry edit box detected; some components ignored.";
 
       if (edits[0].media_time < 0) {
         DVLOG(1) << "Empty edit list entry ignored.";
       } else {
         edit_list_offset = -edits[0].media_time;
       }
     }
 
     SampleToGroupIterator sample_to_group_itr(traf.sample_to_group);
     bool is_sample_to_group_valid = sample_to_group_itr.IsValid();
 
     int64_t run_start_dts = traf.decode_time.decode_time;
-    int sample_count_sum = 0;
+    uint64_t sample_count_sum = 0;
     for (size_t j = 0; j < traf.runs.size(); j++) {
       const TrackFragmentRun& trun = traf.runs[j];
       TrackRunInfo tri;
       tri.track_id = traf.header.track_id;
       tri.timescale = trak->media.header.timescale;
       tri.start_dts = run_start_dts;
       tri.sample_start_offset = trun.data_offset;
       tri.track_sample_encryption_group =
           &trak->media.information.sample_table.sample_group_description;
       tri.fragment_sample_encryption_info =
@@ skipping 11 matching lines @@
       } else {
         RCHECK(!stsd.video_entries.empty());
         if (desc_idx > stsd.video_entries.size())
           desc_idx = 0;
         tri.video_description = &stsd.video_entries[desc_idx];
         default_iv_size =
             tri.video_description->sinf.info.track_encryption.default_iv_size;
       }
 
       // Initialize aux_info variables only if no sample encryption entries.
-      if (sample_encrytion_entries_count == 0 &&
+      if (sample_encryption_entries_count == 0 &&
           traf.auxiliary_offset.offsets.size() > j) {
         // Collect information from the auxiliary_offset entry with the same
         // index in the 'saiz' container as the current run's index in the
         // 'trun' container, if it is present.
         // There should be an auxiliary info entry corresponding to each sample
         // in the auxiliary offset entry's corresponding track run.
         RCHECK(traf.auxiliary_size.sample_count >=
                sample_count_sum + trun.sample_count);
         tri.aux_info_start_offset = traf.auxiliary_offset.offsets[j];
         tri.aux_info_default_size =
@@ skipping 39 matching lines @@
           tri.samples[k].cenc_group_description_index = 0;
           continue;
         }
 
         uint32_t index = sample_to_group_itr.group_description_index();
         tri.samples[k].cenc_group_description_index = index;
         if (index != 0)
           RCHECK(GetSampleEncryptionInfoEntry(tri, index));
         is_sample_to_group_valid = sample_to_group_itr.Advance();
       }
-      if (sample_encrytion_entries_count > 0) {
-        RCHECK(sample_encrytion_entries_count >=
+      if (sample_encryption_entries_count > 0) {
+        RCHECK(sample_encryption_entries_count >=
                sample_count_sum + trun.sample_count);
         tri.sample_encryption_entries.resize(trun.sample_count);
         for (size_t k = 0; k < trun.sample_count; k++) {
           uint32_t index = tri.samples[k].cenc_group_description_index;
           const uint8_t iv_size =
               index == 0 ? default_iv_size
                          : GetSampleEncryptionInfoEntry(tri, index)->iv_size;
           RCHECK(tri.sample_encryption_entries[k].Parse(
               sample_encryption_reader.get(), iv_size,
               traf.sample_encryption.use_subsample_encryption));
@@ skipping 226 matching lines @@
 }
 
 uint8_t TrackRunIterator::GetIvSize(size_t sample_index) const {
   uint32_t index = GetGroupDescriptionIndex(sample_index);
   return (index == 0) ? track_encryption().default_iv_size
                       : GetSampleEncryptionInfoEntry(*run_itr_, index)->iv_size;
 }
 
 }  // namespace mp4
 }  // namespace media