MSE: Fix Mp4 SAIO parsing overflow

media/formats/mp4/box_definitions.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/box_definitions.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 106 matching lines @@
     const SampleAuxiliaryInformationOffset& other) = default;
 SampleAuxiliaryInformationOffset::~SampleAuxiliaryInformationOffset() {}
 FourCC SampleAuxiliaryInformationOffset::BoxType() const { return FOURCC_SAIO; }
 
 bool SampleAuxiliaryInformationOffset::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFullBoxHeader());
   if (reader->flags() & 1)
     RCHECK(reader->SkipBytes(8));
 
   uint32_t count;
-  RCHECK(reader->Read4(&count) &&
-         reader->HasBytes(count * (reader->version() == 1 ? 8 : 4)));
+  RCHECK(reader->Read4(&count));
+  int bytes_per_offset = reader->version() == 1 ? 8 : 4;
+
+  // Cast |count| to size_t before multiplying to support maximum platform size.
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_offset, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SAIO count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= offsets.max_size());
   offsets.resize(count);
 
   for (uint32_t i = 0; i < count; i++) {
     if (reader->version() == 1) {
       RCHECK(reader->Read8(&offsets[i]));
     } else {
       RCHECK(reader->Read4Into8(&offsets[i]));
     }
   }
   return true;
@@ skipping 978 matching lines @@
     data_offset = 0;
   }
 
   uint32_t first_sample_flags = 0;
   if (first_sample_flags_present)
     RCHECK(reader->Read4(&first_sample_flags));
 
   int fields = sample_duration_present + sample_size_present +
       sample_flags_present + sample_composition_time_offsets_present;
 
-  // |bytes_needed| is potentially 64-bit. Cast |sample_count| from uint32_t to
-  // size_t to avoid multiplication overflow.
+  // Cast |sample_count| to size_t before multiplying to support maximum
+  // platform size.
   base::CheckedNumeric<size_t> bytes_needed =
       base::CheckMul(fields, static_cast<size_t>(sample_count));
   RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
                       "Extreme TRUN sample count exceeds system address space");
   RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
 
   if (sample_duration_present) {
     RCHECK(sample_count <= sample_durations.max_size());
     sample_durations.resize(sample_count);
   }
@@ skipping 220 matching lines @@
 SampleDependsOn IndependentAndDisposableSamples::sample_depends_on(
     size_t i) const {
   if (i >= sample_depends_on_.size())
     return kSampleDependsOnUnknown;
 
   return sample_depends_on_[i];
 }
 
 }  // namespace mp4
 }  // namespace media