Add extra checks to avoid integer overflow.

media/base/container_names.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/base/container_names.h"
 
 #include <cctype>
 #include <limits>
 
 #include "base/basictypes.h"
@@ skipping 105 matching lines @@
 
     // Check sampling frequency index.
     RCHECK(ReadBits(&reader, 4) != 15);  // Forbidden.
 
     // Skip private stream, channel configuration, originality, home,
     // copyrighted stream, and copyright_start.
     reader.SkipBits(1 + 3 + 1 + 1 + 1 + 1);
 
     // Get frame length (includes header).
     int size = ReadBits(&reader, 13);
-    RCHECK(size > 0);
+    RCHECK(size > 0 && size < 8192);

[DaleCurtis, 2014/10/24 17:37:01]

Why not < buffer_size ?

[jrummell, 2014/10/24 18:09:49]

RCHECK() returns false if the condition is not met. Having the offset go off the
end of the buffer may do something different (in this case it returns true), so
I didn't want to affect that.

And they're not really magic numbers. 2**13 = 8192, and is the largest value
that the line above should return. It doesn't add much, but makes it clear that
what gets added to offset is not close to maxint.

[xhwang, 2014/10/24 21:04:28]

Does the spec say the size can't be 8192?

[xhwang, 2014/10/24 21:04:59]

This is an old comment. Please ignore.

     offset += size;
   }
   return true;
 }
 
 const uint16 kAc3SyncWord = 0x0b77;
 
 // Checks for an AC3 container.
 static bool CheckAc3(const uint8* buffer, int buffer_size) {
   // Reference: ATSC Standard: Digital Audio Compression (AC-3, E-AC-3)
@@ skipping 46 matching lines @@
     RCHECK(ReadBits(&reader, 16) == kAc3SyncWord);
 
     // Verify strmtyp.
     RCHECK(ReadBits(&reader, 2) != 3);
 
     // Skip substreamid.
     reader.SkipBits(3);
 
     // Get frmsize. Include syncinfo size and convert to bytes.
     int frame_size = (ReadBits(&reader, 11) + 1) * 2;
-    RCHECK(frame_size >= 7);
+    RCHECK(frame_size >= 7 && frame_size <= 4096);

[DaleCurtis, 2014/10/24 17:37:01]

ditto?

 
     // Skip fscod, fscod2, acmod, and lfeon.
     reader.SkipBits(2 + 2 + 3 + 1);
 
     // Verify bsid.
     int bit_stream_id = ReadBits(&reader, 5);
     RCHECK(bit_stream_id >= 11 && bit_stream_id <= 16);
 
     offset += frame_size;
   }
@@ skipping 84 matching lines @@
     reader.SkipBits(1 + 5);
 
     // Verify CRC present flag.
     RCHECK(ReadBits(&reader, 1) == 0);  // CPF must be 0.
 
     // Verify number of PCM sample blocks.
     RCHECK(ReadBits(&reader, 7) >= 5);
 
     // Verify primary frame byte size.
     int frame_size = ReadBits(&reader, 14);
-    RCHECK(frame_size >= 95);
+    RCHECK(frame_size >= 95 && frame_size < 16384);
 
     // Skip audio channel arrangement.
     reader.SkipBits(6);
 
     // Verify core audio sampling frequency is an allowed value.
     RCHECK(kSamplingFrequencyValid[ReadBits(&reader, 4)]);
 
     // Verify transmission bit rate is valid.
     RCHECK(ReadBits(&reader, 5) <= 25);
 
@@ skipping 353 matching lines @@
     } else if (code >= 0xd0 && code <= 0xd7) {
       // RST (restart) codes must be in sequence. No other data with header.
       int restart = code & 0x07;
       if (last_restart >= 0)
         RCHECK(restart == (last_restart + 1) % 8);
       last_restart = restart;
       offset += 2;
     } else {
       // All remaining marker codes are followed by a length of the header.
       int length = Read16(buffer + offset + 2) + 2;
+      RCHECK(length > 0 && length < 65538);
 
       // Special handling of SOS (start of scan) marker since the entropy
       // coded data follows the SOS. Any xFF byte in the data block must be
       // followed by x00 in the data.
       if (code == 0xda) {
         int number_components = buffer[offset + 4];
         RCHECK(length == 8 + 2 * number_components);
 
         // Advance to the next marker.
         offset += length;
@@ skipping 97 matching lines @@
       else
         RCHECK(stream_id != 0xfc && stream_id != 0xfd && stream_id != 0xfe);
 
       // Some stream types are used for pack headers.
       if (stream_id == PACK_START_CODE)  // back to outer loop.
         break;
       if (stream_id == PROGRAM_END_CODE)  // end of stream.
         return true;
 
       int pes_length = Read16(buffer + offset + 4);
-      RCHECK(pes_length > 0);
+      RCHECK(pes_length > 0 && pes_length < 32768);
       offset = offset + 6 + pes_length;
     }
   }
   // Success as we are off the end of the buffer and liked everything
   // in the buffer.
   return true;
 }
 
 const uint8 kMpeg2SyncWord = 0x47;
 
@@ skipping 178 matching lines @@
         return false;
     }
     if (atomsize == 1) {
       // Indicates that the length is the next 64bits.
       if (offset + 16 > buffer_size)
         break;
       if (Read32(buffer + offset + 8) != 0)
         break;  // Offset is way past buffer size.
       atomsize = Read32(buffer + offset + 12);
     }
-    if (atomsize <= 0)
+    if (atomsize <= 0 || atomsize > buffer_size)
       break;  // Indicates the last atom or length too big.
     offset += atomsize;
   }
   return true;
 }
 
 enum MPEGVersion {
   VERSION_25 = 0,
   VERSION_RESERVED,
   VERSION_2,
@@ skipping 107 matching lines @@
       ++offset;
   }
 
   while (offset + 3 < buffer_size) {
     RCHECK(ValidMpegAudioFrameHeader(
         buffer + offset, buffer_size - offset, &framesize));
 
     // Have we seen enough valid headers?
     if (++numSeen > 10)
       return true;
+
+    RCHECK(framesize > 0 && framesize < 8192);
     offset += framesize;
   }
   // Off the end of the buffer, return success if a few valid headers seen.
   return numSeen > 2;
 }
 
 // Check that the next characters in |buffer| represent a number. The format
 // accepted is optional whitespace followed by 1 or more digits. |max_digits|
 // specifies the maximum number of digits to process. Returns true if a valid
 // number is found, false otherwise.
@@ skipping 538 matching lines @@
     if (CheckEac3(buffer + offset, buffer_size - offset))
       return CONTAINER_EAC3;
   }
 
   return CONTAINER_UNKNOWN;
 }
 
 }  // namespace container_names
 
 }  // namespace media