Fix silent truncations when extracting values from CheckedNumeric

content/renderer/pepper/pepper_media_stream_track_host_base.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_media_stream_track_host_base.h"
 
 #include <utility>
 
 #include "base/logging.h"
 #include "base/numerics/safe_math.h"
@@ skipping 29 matching lines @@
   DCHECK_GT(buffer_size,
             static_cast<int32_t>(sizeof(ppapi::MediaStreamBuffer::Header)));
   // Make each buffer 4 byte aligned.
   base::CheckedNumeric<int32_t> buffer_size_aligned = buffer_size;
   // TODO(amistry): "buffer size" might not == "buffer stride", in the same way
   // that width != stride in an image buffer.
   buffer_size_aligned += (4 - buffer_size % 4);
 
   // TODO(penghuang): |HostAllocateSharedMemoryBuffer| uses sync IPC. We should
   // avoid it.
-  base::CheckedNumeric<int32_t> size = number_of_buffers * buffer_size_aligned;
+  base::CheckedNumeric<uint32_t> size = number_of_buffers * buffer_size_aligned;
   if (!size.IsValid())
     return false;
 
   content::RenderThread* render_thread = content::RenderThread::Get();
   std::unique_ptr<base::SharedMemory> shm(
       render_thread->HostAllocateSharedMemoryBuffer(size.ValueOrDie()));
   if (!shm)
     return false;
 
   base::SharedMemoryHandle shm_handle = shm->handle();
@@ skipping 50 matching lines @@
   return PP_OK;
 }
 
 int32_t PepperMediaStreamTrackHostBase::OnHostMsgClose(
     HostMessageContext* context) {
   OnClose();
   return PP_OK;
 }
 
 }  // namespace content