angler-fishThe Vulnerability History Project

MSE: Fix Mp4 TRUN parsing overflow

      TrackFragmentRun::Parse
sample_count can take any value between 0x0 and 0xffffffff. We must
check for size_t overflow when multiplying sample_count by &quotfields&quot.
We should also avoid attempting to resize vectors beyond their
max_size() (potential OOB depending on stl library impl).

BUG=679640,
TEST=unit test, manual verification of POC.

Review-Url: https://codereview.chromium.org/2643573003
Cr-Commit-Position: refs/heads/master@{#444524}
    
commit 24f5635bb25006c6ac263c47e64c8b1cfa0b0f7a
+5 -21
+26 -44
expand_less