diff --git a/chrome/utility/safe_browsing/mac/hfs.cc b/chrome/utility/safe_browsing/mac/hfs.cc
--- a/chrome/utility/safe_browsing/mac/hfs.cc
+++ b/chrome/utility/safe_browsing/mac/hfs.cc
@@ -701,7 +701,9 @@ bool HFSBTreeIterator::Next() {
 bool HFSBTreeIterator::SeekToNode(uint32_t node_id) {
   if (node_id >= header_.totalNodes)
     return false;
-  size_t offset = node_id * header_.nodeSize;
+  // node_id (uint32_t) * nodeSize (uint16_t) can exceed 32 bits; compute the
+  // product in size_t to avoid truncation of attacker-supplied values.
+  size_t offset = base::CheckMul<size_t>(node_id, header_.nodeSize).ValueOrDie();
   if (stream_->Seek(offset, SEEK_SET) != -1) {
     current_leaf_number_ = node_id;
     return true;