Ensure DiscardPadding is parsed as a signed integer.

media/formats/webm/webm_cluster_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/webm/webm_cluster_parser.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "base/sys_byteorder.h"
@@ skipping 173 matching lines @@
   switch (id) {
     case kWebMIdTimecode:
       dst = &cluster_timecode_;
       break;
     case kWebMIdBlockDuration:
       dst = &block_duration_;
       break;
     case kWebMIdBlockAddID:
       dst = &block_add_id_;
       break;
-    case kWebMIdDiscardPadding:
-      if (discard_padding_set_)
-        return false;
-      discard_padding_set_ = true;
-      discard_padding_ = val;
-      return true;
     default:
       return true;
   }
   if (*dst != -1)
     return false;
   *dst = val;
   return true;
 }
 
 bool WebMClusterParser::ParseBlock(bool is_simple_block, const uint8* buf,
@@ skipping 61 matching lines @@
       // First 8 bytes of side_data in DecoderBuffer is the BlockAddID
       // element's value in Big Endian format. This is done to mimic ffmpeg
       // demuxer's behavior.
       block_additional_data_size_ = size + sizeof(block_add_id);
       block_additional_data_.reset(new uint8[block_additional_data_size_]);
       memcpy(block_additional_data_.get(), &block_add_id,
              sizeof(block_add_id));
       memcpy(block_additional_data_.get() + 8, data, size);
       return true;
     }
+    case kWebMIdDiscardPadding: {
+      if (discard_padding_set_ || size <= 0 || size > 8)
+        return false;
+      discard_padding_set_ = true;
 
+      // Read in the big-endian integer.
+      discard_padding_ = static_cast<int8>(data[0]);
+      for (int i = 1; i < size; ++i)
+        discard_padding_ = (discard_padding_ << 8) | data[i];
+
+      return true;
+    }
     default:
       return true;
   }
 }
 
 bool WebMClusterParser::OnBlock(bool is_simple_block, int track_num,
                                 int timecode,
                                 int  block_duration,
                                 int flags,
                                 const uint8* data, int size,
@@ skipping 282 matching lines @@
 WebMClusterParser::FindTextTrack(int track_num) {
   const TextTrackMap::iterator it = text_track_map_.find(track_num);
 
   if (it == text_track_map_.end())
     return NULL;
 
   return &it->second;
 }
 
 }  // namespace media