MSE: Fix Mp4 SAIO parsing overflow

media/formats/mp4/box_definitions.cc

Index: media/formats/mp4/box_definitions.cc
diff --git a/media/formats/mp4/box_definitions.cc b/media/formats/mp4/box_definitions.cc
index 83103be6a513498edaf4a7d3560161e0274852d4..5e57a76a60dece20ba2559f01d8646b4fbfa9358 100644
--- a/media/formats/mp4/box_definitions.cc
+++ b/media/formats/mp4/box_definitions.cc
@@ -124,8 +124,18 @@ bool SampleAuxiliaryInformationOffset::Parse(BoxReader* reader) {
     RCHECK(reader->SkipBytes(8));
 
   uint32_t count;
-  RCHECK(reader->Read4(&count) &&
-         reader->HasBytes(count * (reader->version() == 1 ? 8 : 4)));
+  RCHECK(reader->Read4(&count));
+  int bytes_per_offset = reader->version() == 1 ? 8 : 4;
+
+  // |bytes_needed| is potentially 64-bit. Cast |count| from uint32_t to size_t
+  // to avoid multiplication overflow.

[sandersd (OOO until July 31), 2017/01/18 23:09:01]

This comment should explain that we want size_t to support the maximum size on
any platform. I'd remove the part about overflow, that's clear from the use of
CheckMul and having it makes it look like the two statements are related.

[chcunningham, 2017/01/18 23:43:50]

Done.

+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckMul(bytes_per_offset, static_cast<size_t>(count));
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SAIO count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= offsets.max_size());
   offsets.resize(count);
 
   for (uint32_t i = 0; i < count; i++) {