[TO 56] Fix mp4 parsing security bugs.

media/formats/mp4/box_definitions.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/mp4/box_definitions.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_number_conversions.h"
 #include "media/base/media_switches.h"
 #include "media/base/video_types.h"
 #include "media/base/video_util.h"
 #include "media/filters/h264_parser.h"
 #include "media/formats/mp4/avc.h"
 #include "media/formats/mp4/es_descriptor.h"
 #include "media/formats/mp4/rcheck.h"
 #include "media/media_features.h"
 
@@ skipping 88 matching lines @@
     const SampleAuxiliaryInformationOffset& other) = default;
 SampleAuxiliaryInformationOffset::~SampleAuxiliaryInformationOffset() {}
 FourCC SampleAuxiliaryInformationOffset::BoxType() const { return FOURCC_SAIO; }
 
 bool SampleAuxiliaryInformationOffset::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFullBoxHeader());
   if (reader->flags() & 1)
     RCHECK(reader->SkipBytes(8));
 
   uint32_t count;
-  RCHECK(reader->Read4(&count) &&
-         reader->HasBytes(count * (reader->version() == 1 ? 8 : 4)));
+  RCHECK(reader->Read4(&count));
+  int bytes_per_offset = reader->version() == 1 ? 8 : 4;
+
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckedNumeric<size_t>(bytes_per_offset);
+  bytes_needed *= count;
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SAIO count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= offsets.max_size());
   offsets.resize(count);
 
   for (uint32_t i = 0; i < count; i++) {
     if (reader->version() == 1) {
       RCHECK(reader->Read8(&offsets[i]));
     } else {
       RCHECK(reader->Read4Into8(&offsets[i]));
     }
   }
   return true;
@@ skipping 36 matching lines @@
     RCHECK(reader->Read1(initialization_vector + i));
 
   if (!has_subsamples) {
     subsamples.clear();
     return true;
   }
 
   uint16_t subsample_count;
   RCHECK(reader->Read2(&subsample_count));
   RCHECK(subsample_count > 0);
+  RCHECK(subsample_count <= subsamples.max_size());
   subsamples.resize(subsample_count);
   for (SubsampleEntry& subsample : subsamples) {
     uint16_t clear_bytes;
     uint32_t cypher_bytes;
     RCHECK(reader->Read2(&clear_bytes) && reader->Read4(&cypher_bytes));
     subsample.clear_bytes = clear_bytes;
     subsample.cypher_bytes = cypher_bytes;
   }
   return true;
 }
@@ skipping 233 matching lines @@
 
 EditList::EditList() {}
 EditList::EditList(const EditList& other) = default;
 EditList::~EditList() {}
 FourCC EditList::BoxType() const { return FOURCC_ELST; }
 
 bool EditList::Parse(BoxReader* reader) {
   uint32_t count;
   RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&count));
 
-  if (reader->version() == 1) {
-    RCHECK(reader->HasBytes(count * 20));
-  } else {
-    RCHECK(reader->HasBytes(count * 12));
-  }
+  const size_t bytes_per_edit = reader->version() == 1 ? 20 : 12;
+
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckedNumeric<size_t>(bytes_per_edit);
+  bytes_needed *= count;
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme ELST count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= edits.max_size());
   edits.resize(count);
 
   for (std::vector<EditListEntry>::iterator edit = edits.begin();
        edit != edits.end(); ++edit) {
     if (reader->version() == 1) {
       RCHECK(reader->Read8(&edit->segment_duration) &&
              reader->Read8s(&edit->media_time));
     } else {
       RCHECK(reader->Read4Into8(&edit->segment_duration) &&
              reader->Read4sInto8s(&edit->media_time));
@@ skipping 628 matching lines @@
   } else {
     data_offset = 0;
   }
 
   uint32_t first_sample_flags = 0;
   if (first_sample_flags_present)
     RCHECK(reader->Read4(&first_sample_flags));
 
   int fields = sample_duration_present + sample_size_present +
       sample_flags_present + sample_composition_time_offsets_present;
-  RCHECK(reader->HasBytes(fields * sample_count));
+  const size_t bytes_per_field = 4;
 
-  if (sample_duration_present)
+  base::CheckedNumeric<size_t> bytes_needed(fields);
+  bytes_needed *= bytes_per_field;
+  bytes_needed *= sample_count;
+  RCHECK_MEDIA_LOGGED(
+      bytes_needed.IsValid(), reader->media_log(),
+      "Extreme TRUN sample count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  if (sample_duration_present) {
+    RCHECK(sample_count <= sample_durations.max_size());
     sample_durations.resize(sample_count);
-  if (sample_size_present)
+  }
+  if (sample_size_present) {
+    RCHECK(sample_count <= sample_sizes.max_size());
     sample_sizes.resize(sample_count);
-  if (sample_flags_present)
+  }
+  if (sample_flags_present) {
+    RCHECK(sample_count <= sample_flags.max_size());
     sample_flags.resize(sample_count);
-  if (sample_composition_time_offsets_present)
+  }
+  if (sample_composition_time_offsets_present) {
+    RCHECK(sample_count <= sample_composition_time_offsets.max_size());
     sample_composition_time_offsets.resize(sample_count);
+  }
 
   for (uint32_t i = 0; i < sample_count; ++i) {
     if (sample_duration_present)
       RCHECK(reader->Read4(&sample_durations[i]));
     if (sample_size_present)
       RCHECK(reader->Read4(&sample_sizes[i]));
     if (sample_flags_present)
       RCHECK(reader->Read4(&sample_flags[i]));
     if (sample_composition_time_offsets_present)
       RCHECK(reader->Read4s(&sample_composition_time_offsets[i]));
@@ skipping 22 matching lines @@
     RCHECK(reader->Read4(&grouping_type_parameter));
 
   if (grouping_type != FOURCC_SEIG) {
     DLOG(WARNING) << "SampleToGroup box with grouping_type '" << grouping_type
                   << "' is not supported.";
     return true;
   }
 
   uint32_t count;
   RCHECK(reader->Read4(&count));
+
+  const size_t bytes_per_entry = 8;
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckedNumeric<size_t>(bytes_per_entry);
+  bytes_needed *= count;
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SBGP count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= entries.max_size());
   entries.resize(count);
   for (uint32_t i = 0; i < count; ++i) {
     RCHECK(reader->Read4(&entries[i].sample_count) &&
            reader->Read4(&entries[i].group_description_index));
   }
   return true;
 }
 
 CencSampleEncryptionInfoEntry::CencSampleEncryptionInfoEntry()
     : is_encrypted(false), iv_size(0) {}
@@ skipping 22 matching lines @@
   const size_t kKeyIdSize = 16;
   const size_t kEntrySize = sizeof(uint32_t) + kKeyIdSize;
   uint32_t default_length = 0;
   if (version == 1) {
       RCHECK(reader->Read4(&default_length));
       RCHECK(default_length == 0 || default_length >= kEntrySize);
   }
 
   uint32_t count;
   RCHECK(reader->Read4(&count));
+
+  // Check that we have at least two bytes for each entry before allocating a
+  // potentially huge entries vector. In reality each entry will require a
+  // variable number of bytes in excess of 2.
+  const int bytes_per_entry = 2;
+  base::CheckedNumeric<size_t> bytes_needed =
+      base::CheckedNumeric<size_t>(bytes_per_entry);
+  bytes_needed *= count;
+  RCHECK_MEDIA_LOGGED(bytes_needed.IsValid(), reader->media_log(),
+                      "Extreme SGPD count exceeds implementation limit.");
+  RCHECK(reader->HasBytes(bytes_needed.ValueOrDie()));
+
+  RCHECK(count <= entries.max_size());
   entries.resize(count);
   for (uint32_t i = 0; i < count; ++i) {
     if (version == 1) {
       if (default_length == 0) {
         uint32_t description_length = 0;
         RCHECK(reader->Read4(&description_length));
         RCHECK(description_length >= kEntrySize);
       }
     }
 
@@ skipping 63 matching lines @@
 IndependentAndDisposableSamples::IndependentAndDisposableSamples(
     const IndependentAndDisposableSamples& other) = default;
 IndependentAndDisposableSamples::~IndependentAndDisposableSamples() {}
 FourCC IndependentAndDisposableSamples::BoxType() const { return FOURCC_SDTP; }
 
 bool IndependentAndDisposableSamples::Parse(BoxReader* reader) {
   RCHECK(reader->ReadFullBoxHeader());
   RCHECK(reader->version() == 0);
   RCHECK(reader->flags() == 0);
 
-  int sample_count = reader->box_size() - reader->pos();
+  size_t sample_count = reader->box_size() - reader->pos();
+  RCHECK(sample_count <= sample_depends_on_.max_size());
   sample_depends_on_.resize(sample_count);
-  for (int i = 0; i < sample_count; ++i) {
+  for (size_t i = 0; i < sample_count; ++i) {
     uint8_t sample_info;
     RCHECK(reader->Read1(&sample_info));
 
     sample_depends_on_[i] =
         static_cast<SampleDependsOn>((sample_info >> 4) & 0x3);
 
     RCHECK(sample_depends_on_[i] != kSampleDependsOnReserved);
   }
 
   return true;
 }
 
 SampleDependsOn IndependentAndDisposableSamples::sample_depends_on(
     size_t i) const {
   if (i >= sample_depends_on_.size())
     return kSampleDependsOnUnknown;
 
   return sample_depends_on_[i];
 }
 
 }  // namespace mp4
 }  // namespace media