Commit message: None
CVE: CVE-2014-7908
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.

Project: Chrome

static bool CheckAac(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size > 6);

  int offset = 0;
  while (offset + 6 < buffer_size) {
    BitReader reader(buffer + offset, 6);

    RCHECK(ReadBits(&reader, 12) == 0xfff);

    reader.SkipBits(1);

    RCHECK(ReadBits(&reader, 2) == 0);

    reader.SkipBits(1 + 2);

    RCHECK(ReadBits(&reader, 4) != 15);  // Forbidden.

    reader.SkipBits(1 + 3 + 1 + 1 + 1 + 1);

    int size = ReadBits(&reader, 13);
    RCHECK(size > 0);
    offset += size;
  }
  return true;
}

Project: Chrome

static bool CheckAc3(const uint8* buffer, int buffer_size) {

  RCHECK(buffer_size > 6);

  int offset = 0;
  while (offset + 6 < buffer_size) {
    BitReader reader(buffer + offset, 6);

    RCHECK(ReadBits(&reader, 16) == kAc3SyncWord);

    reader.SkipBits(16);

    int sample_rate_code = ReadBits(&reader, 2);
    RCHECK(sample_rate_code != 3);  // Reserved.

    int frame_size_code = ReadBits(&reader, 6);
    RCHECK(frame_size_code < 38);  // Undefined.

    RCHECK(ReadBits(&reader, 5) < 10);  // Normally 8 or 6, 16 used by EAC3.

    offset += kAc3FrameSizeTable[frame_size_code][sample_rate_code];
  }
  return true;
}

Project: Chrome

static bool CheckBink(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size >= 44);

  RCHECK(Read32LE(buffer + 8) > 0);

  int width = Read32LE(buffer + 20);
  RCHECK(width > 0 && width <= 32767);

  int height = Read32LE(buffer + 24);
  RCHECK(height > 0 && height <= 32767);

  RCHECK(Read32LE(buffer + 28) > 0);

  RCHECK(Read32LE(buffer + 32) > 0);

  return (Read32LE(buffer + 40) <= 256);
}

Project: Chrome

static bool CheckGsm(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size >= 1024);  // Need enough data to do a decent check.

  int offset = 0;
  while (offset < buffer_size) {
    RCHECK((buffer[offset] & 0xf0) == 0xd0);
    offset += 33;
  }
  return true;
}

Project: Chrome

static bool CheckH263(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size > 16);

  int offset = 0;
  bool seen_start_code = false;
  while (true) {
    if (!AdvanceToStartCode(buffer, buffer_size, &offset, 9, 22, 0x20)) {
      return seen_start_code;
    }

    BitReader reader(buffer + offset, 9);
    RCHECK(ReadBits(&reader, 22) == 0x20);

    reader.SkipBits(8);

    RCHECK(ReadBits(&reader, 2) == 2);

    reader.SkipBits(1 + 1 + 1);

    int format = ReadBits(&reader, 3);
    RCHECK(format != 0 && format != 6);  // Forbidden or reserved.

    if (format == 7) {
      int ufep = ReadBits(&reader, 3);
      if (ufep == 1) {
        format = ReadBits(&reader, 3);
        RCHECK(format != 0 && format != 7);  // Reserved.
        reader.SkipBits(11);
        RCHECK(ReadBits(&reader, 4) == 8);  // Not allowed.
      } else {
        RCHECK(ufep == 0);  // Only 0 and 1 allowed.
      }

      int picture_type_code = ReadBits(&reader, 3);
      RCHECK(picture_type_code != 6 && picture_type_code != 7);  // Reserved.

      reader.SkipBits(1 + 1 + 1);

      RCHECK(ReadBits(&reader, 3) == 1);  // Not allowed.
    }

    seen_start_code = true;
    offset += 9;
  }
}

Project: Chrome

static bool CheckMp3(const uint8* buffer, int buffer_size, bool seenHeader) {
  RCHECK(buffer_size >= 10);  // Must be enough to read the initial header.

  int framesize;
  int numSeen = 0;
  int offset = 0;
  if (seenHeader) {
    offset = GetMp3HeaderSize(buffer, buffer_size);
  } else {
    while (offset < buffer_size && buffer[offset] == 0)
      ++offset;
  }

  while (offset + 3 < buffer_size) {
    RCHECK(ValidMpegAudioFrameHeader(
        buffer + offset, buffer_size - offset, &framesize));

    if (++numSeen > 10)
      return true;
    offset += framesize;
  }
  return numSeen > 2;
}