| commit | 24f5635bb25006c6ac263c47e64c8b1cfa0b0f7a | [log] [tgz] |
|---|---|---|
| author | chcunningham <chcunningham@chromium.org> | Wed Jan 18 22:53:52 2017 |
| committer | Commit bot <commit-bot@chromium.org> | Wed Jan 18 22:53:52 2017 |
| tree | f76e580ab917e64b6a84d5403dfa8d291396d023 | |
| parent | 96205c442a254bfedf737c97f836c7bfd1973d29 [diff] |
MSE: Fix Mp4 TRUN parsing overflow TrackFragmentRun::Parse sample_count can take any value between 0x0 and 0xffffffff. We must check for size_t overflow when multiplying sample_count by "fields". We should also avoid attempting to resize vectors beyond their max_size() (potential OOB depending on stl library impl). BUG=679640, TEST=unit test, manual verification of POC. Review-Url: https://codereview.chromium.org/2643573003 Cr-Commit-Position: refs/heads/master@{#444524}