Fix silent truncations when extracting values from CheckedNumeric

components/webcrypto/algorithms/aes_cbc.cc

+
 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/numerics/safe_math.h"
@@ skipping 37 matching lines @@
     return Status::ErrorIncorrectSizeAesCbcIv();
 
   // According to the openssl docs, the amount of data written may be as large
   // as (data_size + cipher_block_size - 1), constrained to a multiple of
   // cipher_block_size.
   base::CheckedNumeric<int> output_max_len = data.byte_length();
   output_max_len += AES_BLOCK_SIZE - 1;
   if (!output_max_len.IsValid())
     return Status::ErrorDataTooLarge();
 
-  const unsigned remainder = output_max_len.ValueOrDie() % AES_BLOCK_SIZE;
+  const unsigned remainder =
+      base::ValueOrDieForType<unsigned>(output_max_len % AES_BLOCK_SIZE);
   if (remainder != 0)
     output_max_len += AES_BLOCK_SIZE - remainder;
   if (!output_max_len.IsValid())
     return Status::ErrorDataTooLarge();
 
   // Note: PKCS padding is enabled by default
   const EVP_CIPHER* const cipher = GetAESCipherByKeyLength(raw_key.size());
   DCHECK(cipher);
 
   bssl::ScopedEVP_CIPHER_CTX context;
   if (!EVP_CipherInit_ex(context.get(), cipher, NULL, &raw_key[0],
                          params->iv().data(), cipher_operation)) {
     return Status::OperationError();
   }
 
-  buffer->resize(output_max_len.ValueOrDie());
+  buffer->resize(base::ValueOrDieForType<size_t>(output_max_len));
 
   int output_len = 0;
   if (!EVP_CipherUpdate(context.get(), buffer->data(), &output_len,
                         data.bytes(), data.byte_length())) {
     return Status::OperationError();
   }
   int final_output_chunk_len = 0;
   if (!EVP_CipherFinal_ex(context.get(), buffer->data() + output_len,
                           &final_output_chunk_len)) {
     return Status::OperationError();
@@ skipping 27 matching lines @@
   }
 };
 
 }  // namespace
 
 std::unique_ptr<AlgorithmImplementation> CreateAesCbcImplementation() {
   return base::WrapUnique(new AesCbcImplementation);
 }
 
 }  // namespace webcrypto