MSE: Fix Mp4 SAIO parsing overflow

media/formats/mp4/box_definitions.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/box_definitions.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 106 matching lines @@
     const SampleAuxiliaryInformationOffset& other) = default;
 SampleAuxiliaryInformationOffset::~SampleAuxiliaryInformationOffset() {}
 FourCC SampleAuxiliaryInformationOffset::BoxType() const { return FOURCC_SAIO; }
 
 bool SampleAuxiliaryInformationOffset::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFullBoxHeader());
   if (reader->flags() & 1)
     RCHECK(reader->SkipBytes(8));
 
   uint32_t count;
-  RCHECK(reader->Read4(&count) &&
-         reader->HasBytes(count * (reader->version() == 1 ? 8 : 4)));
+  RCHECK(reader->Read4(&count));
+  int bytes_per_offset = reader->version() == 1 ? 8 : 4;
+
+  // |bytes_needed| is potentially 64-bit. Cast |count| from uint32_t to size_t
+  // to avoid multiplication overflow.

[sandersd (OOO until July 31), 2017/01/18 23:09:01]

This comment should explain that we want size_t to support the maximum size on
any platform. I'd remove the part about overflow, that's clear from the use of
CheckMul and having it makes it look like the two statements are related.

[chcunningham, 2017/01/18 23:43:50]

Done.

+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_offset, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SAIO count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= offsets.max_size());
   offsets.resize(count);
 
   for (uint32_t i = 0; i < count; i++) {
     if (reader->version() == 1) {
       RCHECK(reader->Read8(&offsets[i]));
     } else {
       RCHECK(reader->Read4Into8(&offsets[i]));
     }
   }
   return true;
@@ skipping 1220 matching lines @@
 SampleDependsOn IndependentAndDisposableSamples::sample_depends_on(
     size_t i) const {
   if (i >= sample_depends_on_.size())
     return kSampleDependsOnUnknown;
 
   return sample_depends_on_[i];
 }
 
 }  // namespace mp4
 }  // namespace media