Bug 1090405 - Ensure that 'samples' is not negative in WebMReader. r=rillian, a=lmandel
authorIan Stakenvicius <axs@gentoo.org>
Tue, 28 Oct 2014 11:43:00 -0400
changeset 225858 ea93efd4cf0a
parent 225857 d38dd7de64b3
child 225859 a7a6e6465c30
push id4041
push userryanvm@gmail.com
push date2014-10-29 18:20 +0000
treeherdermozilla-beta@79567465c505 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrillian, lmandel
bugs1090405
milestone34.0
Bug 1090405 - Ensure that 'samples' is not negative in WebMReader. r=rillian, a=lmandel
content/media/webm/WebMReader.cpp
--- a/content/media/webm/WebMReader.cpp
+++ b/content/media/webm/WebMReader.cpp
@@ -663,17 +663,25 @@ bool WebMReader::DecodeAudioPacket(neste
         if (skipFrames == frames) {
           // discard the whole packet
           mSkip -= frames;
           LOG(PR_LOG_DEBUG, ("Opus decoder skipping %d frames"
                              " (whole packet)", frames));
           return true;
         }
         int32_t keepFrames = frames - skipFrames;
+        if (keepFrames < 0) {
+          NS_WARNING("Int overflow in keepFrames");
+          return false;
+	}
         int samples = keepFrames * channels;
+	if (samples < 0) {
+          NS_WARNING("Int overflow in samples");
+          return false;
+	}
         nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
         for (int i = 0; i < samples; i++)
           trimBuffer[i] = buffer[skipFrames*channels + i];
         startTime = startTime + FramesToUsecs(skipFrames, rate);
         frames = keepFrames;
         buffer = trimBuffer;
 
         mSkip -= skipFrames;
@@ -686,16 +694,20 @@ bool WebMReader::DecodeAudioPacket(neste
         CheckedInt64 discardFrames = UsecsToFrames(discardPadding * NS_PER_USEC, rate);
         if (!discardFrames.isValid()) {
           NS_WARNING("Int overflow in DiscardPadding");
           return false;
         }
         int32_t keepFrames = frames - discardFrames.value();
         if (keepFrames > 0) {
           int samples = keepFrames * channels;
+          if (samples < 0) {
+            NS_WARNING("Int overflow in samples");
+            return false;
+          }
           nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
           for (int i = 0; i < samples; i++)
             trimBuffer[i] = buffer[i];
           frames = keepFrames;
           buffer = trimBuffer;
         } else {
           LOG(PR_LOG_DEBUG, ("Opus decoder discarding whole packet"
                              " ( %d frames) as padding", frames));