Fix boundary check problems in socket_host.cc. See the bug for the full list of security issues fix…

content/browser/renderer_host/p2p/socket_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_P2P_SOCKET_HOST_H_
 #define CONTENT_BROWSER_RENDERER_HOST_P2P_SOCKET_HOST_H_
 
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/common/p2p_socket_type.h"
@@ skipping 15 matching lines @@
 
 namespace content {
 class P2PMessageThrottler;
 
 namespace packet_processing_helpers {
 
 // This method can handle only RTP packet, otherwise this method must not be
 // called. It will try to do, 1. update absolute send time extension header
 // if present with current time and 2. update HMAC in RTP packet.
 // If abs_send_time is 0, ApplyPacketOption will get current time from system.
-CONTENT_EXPORT bool ApplyPacketOptions(char* data, int length,
+CONTENT_EXPORT bool ApplyPacketOptions(char* data,
+                                       size_t length,
                                        const rtc::PacketOptions& options,
                                        uint32 abs_send_time);
 
 // Helper method which finds RTP ofset and length if the packet is encapsulated
 // in a TURN Channel Message or TURN Send Indication message.
-CONTENT_EXPORT bool GetRtpPacketStartPositionAndLength(const char* data,
-                                                       int length,
-                                                       int* rtp_start_pos,
-                                                       int* rtp_packet_length);
+CONTENT_EXPORT bool GetRtpPacketStartPositionAndLength(
+    const char* data,
+    size_t length,
+    size_t* rtp_start_pos,
+    size_t* rtp_packet_length);
+
 // Helper method which updates absoulute send time extension if present.
-CONTENT_EXPORT bool UpdateRtpAbsSendTimeExtn(char* rtp, int length,
-                                             int extension_id,
-                                             uint32 abs_send_time);
+CONTENT_EXPORT bool UpdateRtpAbsSendTimeExtension(char* rtp,
+                                                  size_t length,
+                                                  int extension_id,
+                                                  uint32 abs_send_time);
 
 }  // packet_processing_helpers
 
 // Base class for P2P sockets.
 class CONTENT_EXPORT P2PSocketHost {
  public:
   static const int kStunHeaderSize = 20;
   // Creates P2PSocketHost of the specific type.
   static P2PSocketHost* Create(IPC::Sender* message_sender,
                                int socket_id,
@@ skipping 86 matching lines @@
   RenderProcessHost::WebRtcRtpPacketCallback packet_dump_callback_;
 
   base::WeakPtrFactory<P2PSocketHost> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(P2PSocketHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_P2P_SOCKET_HOST_H_