MSE: Fix moar mp4 parsing security bugs.

media/formats/mp4/box_definitions.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/box_definitions.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 175 matching lines @@
     RCHECK(reader->Read1(initialization_vector + i));
 
   if (!has_subsamples) {
     subsamples.clear();
     return true;
   }
 
   uint16_t subsample_count;
   RCHECK(reader->Read2(&subsample_count));
   RCHECK(subsample_count > 0);
+  RCHECK(subsample_count <= subsamples.max_size());
   subsamples.resize(subsample_count);
   for (SubsampleEntry& subsample : subsamples) {
     uint16_t clear_bytes;
     uint32_t cypher_bytes;
     RCHECK(reader->Read2(&clear_bytes) && reader->Read4(&cypher_bytes));
     subsample.clear_bytes = clear_bytes;
     subsample.cypher_bytes = cypher_bytes;
   }
   return true;
 }
@@ skipping 269 matching lines @@
 
 EditList::EditList() {}
 EditList::EditList(const EditList& other) = default;
 EditList::~EditList() {}
 FourCC EditList::BoxType() const { return FOURCC_ELST; }
 
 bool EditList::Parse(BoxReader* reader) {
   uint32_t count;
   RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&count));
 
-  if (reader->version() == 1) {
-    RCHECK(reader->HasBytes(count * 20));
-  } else {
-    RCHECK(reader->HasBytes(count * 12));
-  }
+  const size_t bytes_per_edit = reader->version() == 1 ? 20 : 12;
+
+  // Cast |count| to size_t before multiplying to support maximum platform size.
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_edit, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme ELST count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= edits.max_size());
   edits.resize(count);
 
   for (std::vector<EditListEntry>::iterator edit = edits.begin();
        edit != edits.end(); ++edit) {
     if (reader->version() == 1) {
       RCHECK(reader->Read8(&edit->segment_duration) &&
              reader->Read8s(&edit->media_time));
     } else {
       RCHECK(reader->Read4Into8(&edit->segment_duration) &&
              reader->Read4sInto8s(&edit->media_time));
@@ skipping 625 matching lines @@
   } else {
     data_offset = 0;
   }
 
   uint32_t first_sample_flags = 0;
   if (first_sample_flags_present)
     RCHECK(reader->Read4(&first_sample_flags));
 
   int fields = sample_duration_present + sample_size_present +
       sample_flags_present + sample_composition_time_offsets_present;
+  const size_t bytes_per_field = 4;
 
   // Cast |sample_count| to size_t before multiplying to support maximum
   // platform size.
-  base::CheckedNumeric<size_t> bytes_needed =
-      base::CheckMul(fields, static_cast<size_t>(sample_count));
-  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
-                      "Extreme TRUN sample count exceeds system address space");
+  base::CheckedNumeric<size_t> bytes_needed = base::CheckMul(
+      fields, bytes_per_field, static_cast<size_t>(sample_count));
+  RCHECK_MEDIA_LOGGED(
+      bytes_needed.IsValid(), reader->media_log(),
+      "Extreme TRUN sample count exceeds implementation limit.");
   RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
 
   if (sample_duration_present) {
     RCHECK(sample_count <= sample_durations.max_size());
     sample_durations.resize(sample_count);
   }
   if (sample_size_present) {
     RCHECK(sample_count <= sample_sizes.max_size());
     sample_sizes.resize(sample_count);
   }
@@ skipping 40 matching lines @@
     RCHECK(reader->Read4(&grouping_type_parameter));
 
   if (grouping_type != FOURCC_SEIG) {
     DLOG(WARNING) << "SampleToGroup box with grouping_type '" << grouping_type
                   << "' is not supported.";
     return true;
   }
 
   uint32_t count;
   RCHECK(reader->Read4(&count));
+
+  const size_t bytes_per_entry = 8;
+  // Cast |count| to size_t before multiplying to support maximum platform size.
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_entry, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SBGP count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= entries.max_size());
   entries.resize(count);
   for (uint32_t i = 0; i < count; ++i) {
     RCHECK(reader->Read4(&entries[i].sample_count) &&
            reader->Read4(&entries[i].group_description_index));
   }
   return true;
 }
 
 CencSampleEncryptionInfoEntry::CencSampleEncryptionInfoEntry()
     : is_encrypted(false),
@@ skipping 60 matching lines @@
 
   const size_t kEntrySize = sizeof(uint32_t) + kKeyIdSize;
   uint32_t default_length = 0;
   if (version == 1) {
       RCHECK(reader->Read4(&default_length));
       RCHECK(default_length == 0 || default_length >= kEntrySize);
   }
 
   uint32_t count;
   RCHECK(reader->Read4(&count));
+
+  // Check that we have at least two bytes for each entry before allocating a
+  // potentially huge entries vector. In reality each entry will require a
+  // variable number of bytes in excess of 2.
+  const int bytes_per_entry = 2;
+  // Cast |count| to size_t before multiplying to support maximum platform size.
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_entry, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SGPD count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= entries.max_size());
   entries.resize(count);
   for (uint32_t i = 0; i < count; ++i) {
     if (version == 1) {
       if (default_length == 0) {
         uint32_t description_length = 0;
         RCHECK(reader->Read4(&description_length));
         RCHECK(description_length >= kEntrySize);
       }
     }
     RCHECK(entries[i].Parse(reader));
@@ skipping 51 matching lines @@
 IndependentAndDisposableSamples::IndependentAndDisposableSamples(
     const IndependentAndDisposableSamples& other) = default;
 IndependentAndDisposableSamples::~IndependentAndDisposableSamples() {}
 FourCC IndependentAndDisposableSamples::BoxType() const { return FOURCC_SDTP; }
 
 bool IndependentAndDisposableSamples::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFullBoxHeader());
   RCHECK(reader->version() == 0);
   RCHECK(reader->flags() == 0);
 
-  int sample_count = reader->box_size() - reader->pos();
+  size_t sample_count = reader->box_size() - reader->pos();
+  RCHECK(sample_count <= sample_depends_on_.max_size());
   sample_depends_on_.resize(sample_count);
-  for (int i = 0; i < sample_count; ++i) {
+  for (size_t i = 0; i < sample_count; ++i) {
     uint8_t sample_info;
     RCHECK(reader->Read1(&sample_info));
 
     sample_depends_on_[i] =
         static_cast<SampleDependsOn>((sample_info >> 4) & 0x3);
 
     RCHECK(sample_depends_on_[i] != kSampleDependsOnReserved);
   }
 
   return true;
 }
 
 SampleDependsOn IndependentAndDisposableSamples::sample_depends_on(
     size_t i) const {
   if (i >= sample_depends_on_.size())
     return kSampleDependsOnUnknown;
 
   return sample_depends_on_[i];
 }
 
 }  // namespace mp4
 }  // namespace media