From 136bb7f450dae7225bb90c721f1616d4e57d1e78 Mon Sep 17 00:00:00 2001
From: Thomas Guilbert <tguilbert@chromium.org>
Date: Thu, 28 May 2026 20:03:07 -0700
Subject: [PATCH] Use checked math before allocating ScopedAudioChannelLayout

This CL fixes a potential issue when trying to allocate a
`ScopedAudioChannelLayout` with a huge number of channels.

The CL fixes the issue by using checked math, and preventing integer
truncation when converting from `size_t` to `int`.

We prefer this approach over adding CHECKs to guard against a channel
count higher than `media::limits::kMaxChannels`, since `kMaxChannels`
(32 channels as of this commit) is lower than some high-end audio
interfaces (e.g. 40 channels), and this could introduce crashes in
otherwise valid scenarios.

Fixed: 513396305
Change-Id: I65f3f41bcffef5ce193f623eeac5d5178cdf6502
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7876673
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Auto-Submit: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Thomas Guilbert <tguilbert@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1638201}
---

diff --git a/media/audio/apple/audio_auhal.cc b/media/audio/apple/audio_auhal.cc
index a1c0f34b..819b082 100644
--- a/media/audio/apple/audio_auhal.cc
+++ b/media/audio/apple/audio_auhal.cc
@@ -174,6 +174,10 @@
 
   auto coreaudio_layout =
       ChannelLayoutToAudioChannelLayout(channel_layout, channels);
+  if (!coreaudio_layout) {
+    DLOG(ERROR) << "Failed to create audio channel layout.";
+    return;
+  }
 
   MaybeMapRearSurroundChannelToSurroundChannel(audio_unit,
                                                coreaudio_layout->layout());
diff --git a/media/audio/mac/avfoundation_output_stream.mm b/media/audio/mac/avfoundation_output_stream.mm
index e4a2052c..1487221 100644
--- a/media/audio/mac/avfoundation_output_stream.mm
+++ b/media/audio/mac/avfoundation_output_stream.mm
@@ -95,6 +95,7 @@
       callback_(nullptr),
       objc_storage_(std::make_unique<ObjCStorage>()),
       audio_bus_(AudioBus::Create(params)) {
+  CHECK(params_.IsValid());
   DVLOG(1)
       << __func__
       << ": Initializing AVFoundationOutputStream with these AudioParameters:: "
@@ -147,6 +148,10 @@
 
   auto scoped_layout = ChannelLayoutToAudioChannelLayout(
       params_.channel_layout(), params_.channels());
+  if (!scoped_layout) {
+    LOG(ERROR) << "Failed to create audio channel layout.";
+    return false;
+  }
 
   OSStatus status = CMAudioFormatDescriptionCreate(
       /*allocator=*/kCFAllocatorDefault,
diff --git a/media/base/mac/channel_layout_util_mac.cc b/media/base/mac/channel_layout_util_mac.cc
index 5c9d3c6..10c341f 100644
--- a/media/base/mac/channel_layout_util_mac.cc
+++ b/media/base/mac/channel_layout_util_mac.cc
@@ -10,6 +10,8 @@
 #include "base/check_op.h"
 #include "base/compiler_specific.h"
 #include "base/containers/span.h"
+#include "base/logging.h"
+#include "base/numerics/safe_math.h"
 #include "media/base/channel_layout.h"
 
 namespace media {
@@ -116,8 +118,21 @@
   //
   // Code modeled after example from Apple documentation here:
   // https://developer.apple.com/library/content/qa/qa1627/_index.html
-  int output_layout_size =
-      offsetof(AudioChannelLayout, mChannelDescriptions[input_channels]);
+  // Modified to use `size_t` and `base::CheckedNumeric` to prevent integer
+  // truncation and overflow.
+  // `AudioChannelLayout` already includes one `AudioChannelDescription` in its
+  // definition, so we allocate space for `input_channels - 1` additional
+  // descriptions.
+  base::CheckedNumeric<size_t> checked_layout_size =
+      sizeof(AudioChannelLayout) +
+      base::CheckedNumeric<size_t>(input_channels - 1) *
+          sizeof(AudioChannelDescription);
+  size_t output_layout_size = 0;
+  if (!checked_layout_size.AssignIfValid(&output_layout_size)) {
+    DLOG(ERROR) << "Invalid AudioChannelLayout size.";
+    return nullptr;
+  }
+
   auto new_layout =
       std::make_unique<ScopedAudioChannelLayout>(output_layout_size);
 
diff --git a/media/filters/mac/audio_toolbox_audio_decoder.cc b/media/filters/mac/audio_toolbox_audio_decoder.cc
index dabd6f0..620b24c 100644
--- a/media/filters/mac/audio_toolbox_audio_decoder.cc
+++ b/media/filters/mac/audio_toolbox_audio_decoder.cc
@@ -376,6 +376,11 @@
   // channel order description. This let decoder output correct orders.
   auto ordered_layout = ChannelLayoutToAudioChannelLayout(
       channel_layout, input_format.mChannelsPerFrame);
+  if (!ordered_layout) {
+    MEDIA_LOG(ERROR, media_log_) << "Failed to create audio channel layout.";
+    return false;
+  }
+
   auto result = AudioConverterSetProperty(
       decoder_.get(), kAudioConverterOutputChannelLayout,
       ordered_layout->layout_size(), ordered_layout->layout());