Bug 1532849 - Prevent arithmetic overflow. r=bryce
authorJean-Yves Avenard <jyavenard@mozilla.com>
Wed, 01 May 2019 23:13:34 +0000
changeset 531015 5abd778efd7aa8a03be09094bc5d0e852856552f
parent 531014 bcb48454bcae0d274f5b238dfb254d64897b5344
child 531016 be38681e82877a61527772e5831ccd6399aec61d
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbryce
bugs1532849
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1532849 - Prevent arithmetic overflow. r=bryce Differential Revision: https://phabricator.services.mozilla.com/D29461
dom/media/ChannelMediaDecoder.cpp
--- a/dom/media/ChannelMediaDecoder.cpp
+++ b/dom/media/ChannelMediaDecoder.cpp
@@ -405,17 +405,18 @@ void ChannelMediaDecoder::DownloadProgre
 
 /* static */ ChannelMediaDecoder::PlaybackRateInfo
 ChannelMediaDecoder::ComputePlaybackRate(const MediaChannelStatistics& aStats,
                                          BaseMediaResource* aResource,
                                          double aDuration) {
   MOZ_ASSERT(!NS_IsMainThread());
 
   int64_t length = aResource->GetLength();
-  if (mozilla::IsFinite<double>(aDuration) && aDuration > 0 && length >= 0) {
+  if (mozilla::IsFinite<double>(aDuration) && aDuration > 0 && length >= 0 &&
+      length / aDuration < UINT32_MAX) {
     return {uint32_t(length / aDuration), true};
   }
 
   bool reliable = false;
   uint32_t rate = aStats.GetRate(&reliable);
   return {rate, reliable};
 }