Ensure DiscardPadding is parsed as a signed integer.

media/formats/webm/webm_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/webm/webm_parser.h"
 
 // This file contains code to parse WebM file elements. It was created
 // from information in the Matroska spec.
 // http://www.matroska.org/technical/specs/index.html
 // This file contains code for encrypted WebM. Current WebM
 // encrypted request for comments specification is here
 // http://wiki.webmproject.org/encryption/webm-encryption-rfc
 
 #include <iomanip>
 
 #include "base/logging.h"
+#include "base/numerics/safe_conversions.h"
 #include "media/formats/webm/webm_constants.h"
 
 namespace media {
 
 enum ElementType {
   UNKNOWN,
   LIST,  // Referred to as Master Element in the Matroska spec.
   UINT,
   FLOAT,
   BINARY,
@@ skipping 84 matching lines @@
   {UINT, kWebMIdSilentTrackNumber},
 };
 
 static const ElementIdInfo kBlockGroupIds[] = {
   {BINARY, kWebMIdBlock},
   {LIST, kWebMIdBlockAdditions},
   {UINT, kWebMIdBlockDuration},
   {UINT, kWebMIdReferencePriority},
   {BINARY, kWebMIdReferenceBlock},
   {BINARY, kWebMIdCodecState},
-  {UINT, kWebMIdDiscardPadding},
+  {BINARY, kWebMIdDiscardPadding},
   {LIST, kWebMIdSlices},
 };
 
 static const ElementIdInfo kBlockAdditionsIds[] = {
   {LIST, kWebMIdBlockMore},
 };
 
 static const ElementIdInfo kBlockMoreIds[] = {
   {UINT, kWebMIdBlockAddID},
   {BINARY, kWebMIdBlockAdditional},
@@ skipping 409 matching lines @@
 
   return -1;
 }
 
 static int ParseUInt(const uint8* buf, int size, int id,
                      WebMParserClient* client) {
   if ((size <= 0) || (size > 8))
     return -1;
 
   // Read in the big-endian integer.
-  int64 value = 0;
+  uint64 value = 0;
   for (int i = 0; i < size; ++i)
     value = (value << 8) | buf[i];
 
+  // We use int64 in place of uint64 everywhere for convenience.  See this bug
+  // for more details: http://crbug.com/366750#c3
+  if (!base::IsValueInRangeForNumericType<int64>(value))
+    return -1;
+
   if (!client->OnUInt(id, value))
     return -1;
 
   return size;
 }
 
 static int ParseFloat(const uint8* buf, int size, int id,
                       WebMParserClient* client) {
 
   if ((size != 4) && (size != 8))
@@ skipping 373 matching lines @@
       if (kSegmentIds[i].id_ == id_b)
         return true;
     }
   }
 
   // kWebMIdSegment siblings.
   return ((id_b == kWebMIdSegment) || (id_b == kWebMIdEBMLHeader));
 }
 
 }  // namespace media