From 936ec5f355c9845ef70495d1e81d37911e7500d1 Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Mon, 13 Apr 2026 19:43:31 -0700
Subject: [PATCH] Turn huge MultiBuffer requests into crashes

These should not happen in practice, though may be theoretically
possible. For safety, promote some DCHECKs to CHECKs.

R=tmathmeyer

Fixed: 501676175
Change-Id: Ia3180e24226a1a98b5edcf29fe9a9e0c710b50c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7759264
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Ted (Chromium) Meyer <tmathmeyer@chromium.org>
Reviewed-by: Ted (Chromium) Meyer <tmathmeyer@chromium.org>
Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1614159}
---

diff --git a/third_party/blink/renderer/platform/media/multi_buffer.cc b/third_party/blink/renderer/platform/media/multi_buffer.cc
index a44fe6b..c5cf4b5 100644
--- a/third_party/blink/renderer/platform/media/multi_buffer.cc
+++ b/third_party/blink/renderer/platform/media/multi_buffer.cc
@@ -409,7 +409,7 @@
         AddProvider(std::move(provider));
         break;
       }
-      DCHECK_GE(pos, 0);
+      CHECK_GE(pos, 0);
       scoped_refptr<media::DataBuffer> data = provider->Read();
       data_.Set(pos, data);
       eof = data->end_of_stream();
diff --git a/third_party/blink/renderer/platform/media/multi_buffer_reader.h b/third_party/blink/renderer/platform/media/multi_buffer_reader.h
index d4ea246..8c86465 100644
--- a/third_party/blink/renderer/platform/media/multi_buffer_reader.h
+++ b/third_party/blink/renderer/platform/media/multi_buffer_reader.h
@@ -12,6 +12,7 @@
 #include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
+#include "base/numerics/safe_conversions.h"
 #include "third_party/blink/renderer/platform/media/multi_buffer.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
 
@@ -113,8 +114,8 @@
 
   // Returns the block for a particular byte position.
   MultiBufferBlockId block(int64_t byte_pos) const {
-    return static_cast<MultiBufferBlockId>(byte_pos >>
-                                           multibuffer_->block_size_shift());
+    return base::checked_cast<MultiBufferBlockId>(
+        byte_pos >> multibuffer_->block_size_shift());
   }
 
   // Returns the block for a particular byte position, rounding up.
diff --git a/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc b/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
index eed1065..b85c64b 100644
--- a/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
+++ b/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
@@ -613,4 +613,49 @@
   multibuffer_.CheckPresentState();
 }
 
+TEST_F(MultiBufferTest, BlockIdOverflowCrashes) {
+  // Mock a DataProvider that reports its position as -2.
+  class MockDataProvider : public MultiBuffer::DataProvider {
+   public:
+    explicit MockDataProvider(MultiBufferBlockId pos) : pos_(pos) {}
+    MultiBufferBlockId Tell() const override { return pos_; }
+    bool Available() const override { return available_; }
+    int64_t AvailableBytes() const override { return 0; }
+    scoped_refptr<media::DataBuffer> Read() override {
+      available_ = false;
+      return media::DataBuffer::CreateEOSBuffer();
+    }
+    void SetDeferred(bool deferred) override {}
+    void set_available(bool available) { available_ = available; }
+
+   private:
+    MultiBufferBlockId pos_;
+    bool available_ = false;
+  };
+
+  // We use -2 because it is the deleted sentinel for the HashMap.
+  MultiBufferBlockId sentinel_pos = -2;
+  auto mock_provider = std::make_unique<MockDataProvider>(sentinel_pos);
+  MockDataProvider* provider_ptr = mock_provider.get();
+  multibuffer_.AddProvider(std::move(mock_provider));
+
+  // Set available to true so OnDataProviderEvent can proceed.
+  provider_ptr->set_available(true);
+
+  // This call is expected to hit a CHECK_GE(pos, 0) in multi_buffer.cc.
+  EXPECT_DEATH(multibuffer_.OnDataProviderEvent(provider_ptr), "");
+}
+
+TEST_F(MultiBufferTest, BlockIdOverflow) {
+  // This test verifies that extremely large byte offsets that would cause
+  // MultiBufferBlockId (int32_t) overflow are caught by base::checked_cast.
+  int64_t huge_pos = 1LL << 45;  // 32TB, overflows when shifted by 8.
+
+  MultiBufferReader reader(&multibuffer_, 0, huge_pos + 1024, false,
+                           base::NullCallback(), task_runner_);
+
+  // This should crash due to base::checked_cast in MultiBufferReader::block.
+  EXPECT_DEATH(reader.Seek(huge_pos), "");
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc b/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
index eed1065..b85c64b 100644
--- a/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
+++ b/third_party/blink/renderer/platform/media/multi_buffer_unittest.cc
@@ -613,4 +613,49 @@
   multibuffer_.CheckPresentState();
 }
 
+TEST_F(MultiBufferTest, BlockIdOverflowCrashes) {
+  // Mock a DataProvider that reports its position as -2.
+  class MockDataProvider : public MultiBuffer::DataProvider {
+   public:
+    explicit MockDataProvider(MultiBufferBlockId pos) : pos_(pos) {}
+    MultiBufferBlockId Tell() const override { return pos_; }
+    bool Available() const override { return available_; }
+    int64_t AvailableBytes() const override { return 0; }
+    scoped_refptr<media::DataBuffer> Read() override {
+      available_ = false;
+      return media::DataBuffer::CreateEOSBuffer();
+    }
+    void SetDeferred(bool deferred) override {}
+    void set_available(bool available) { available_ = available; }
+
+   private:
+    MultiBufferBlockId pos_;
+    bool available_ = false;
+  };
+
+  // We use -2 because it is the deleted sentinel for the HashMap.
+  MultiBufferBlockId sentinel_pos = -2;
+  auto mock_provider = std::make_unique<MockDataProvider>(sentinel_pos);
+  MockDataProvider* provider_ptr = mock_provider.get();
+  multibuffer_.AddProvider(std::move(mock_provider));
+
+  // Set available to true so OnDataProviderEvent can proceed.
+  provider_ptr->set_available(true);
+
+  // This call is expected to hit a CHECK_GE(pos, 0) in multi_buffer.cc.
+  EXPECT_DEATH(multibuffer_.OnDataProviderEvent(provider_ptr), "");
+}
+
+TEST_F(MultiBufferTest, BlockIdOverflow) {
+  // This test verifies that extremely large byte offsets that would cause
+  // MultiBufferBlockId (int32_t) overflow are caught by base::checked_cast.
+  int64_t huge_pos = 1LL << 45;  // 32TB, overflows when shifted by 8.
+
+  MultiBufferReader reader(&multibuffer_, 0, huge_pos + 1024, false,
+                           base::NullCallback(), task_runner_);
+
+  // This should crash due to base::checked_cast in MultiBufferReader::block.
+  EXPECT_DEATH(reader.Seek(huge_pos), "");
+}
+
 }  // namespace blink