Add extra checks to avoid integer overflow.

media/base/container_names.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/base/container_names.h"
 
 #include <cctype>
 #include <limits>
 
 #include "base/basictypes.h"
@@ skipping 936 matching lines @@
 }
 
 // Additional checks for a MOV/QuickTime/MPEG4 container.
 static bool CheckMov(const uint8* buffer, int buffer_size) {
   // Reference: ISO/IEC 14496-12:2005(E).
   // (http://standards.iso.org/ittf/PubliclyAvailableStandards/c061988_ISO_IEC_14496-12_2012.zip)
   RCHECK(buffer_size > 8);
 
   int offset = 0;
   while (offset + 8 < buffer_size) {
-    int atomsize = Read32(buffer + offset);
+    uint32 atomsize = Read32(buffer + offset);
     uint32 atomtype = Read32(buffer + offset + 4);
     // Only need to check for ones that are valid at the top level.
     switch (atomtype) {
       case TAG('f','t','y','p'):
       case TAG('p','d','i','n'):
       case TAG('m','o','o','v'):
       case TAG('m','o','o','f'):
       case TAG('m','f','r','a'):
       case TAG('m','d','a','t'):
       case TAG('f','r','e','e'):
@@ skipping 10 matching lines @@
         return false;
     }
     if (atomsize == 1) {
       // Indicates that the length is the next 64bits.
       if (offset + 16 > buffer_size)
         break;
       if (Read32(buffer + offset + 8) != 0)
         break;  // Offset is way past buffer size.
       atomsize = Read32(buffer + offset + 12);
     }
-    if (atomsize <= 0)
+    if (atomsize == 0 || atomsize > static_cast<unsigned>(buffer_size))

[DaleCurtis, 2014/10/24 20:51:35]

Hmm we don't typically use unsigned, maybe size_t instead?

[jrummell, 2014/10/24 23:18:29]

Done.

       break;  // Indicates the last atom or length too big.
     offset += atomsize;
   }
   return true;
 }
 
 enum MPEGVersion {
   VERSION_25 = 0,
   VERSION_RESERVED,
   VERSION_2,
@@ skipping 665 matching lines @@
     if (CheckEac3(buffer + offset, buffer_size - offset))
       return CONTAINER_EAC3;
   }
 
   return CONTAINER_UNKNOWN;
 }
 
 }  // namespace container_names
 
 }  // namespace media