Fix InMemoryUrlProtocol available_bytes computation.

Fixed available_bytes computation to properly handle large buffers and
add defensive logic to Read() to protect against negative sizes.

BUG=364065
TESTS=InMemoryUrlProtocolTest.*

Review URL: https://codereview.chromium.org/253923002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@267280 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 66 insertions, 3 deletions

diff --git a/media/filters/in_memory_url_protocol.cc b/media/filters/in_memory_url_protocol.cc
index 85fa290..da8a7dd 100644
--- a/media/filters/in_memory_url_protocol.cc
+++ b/media/filters/in_memory_url_protocol.cc
@@ -4,6 +4,8 @@
 
 #include "media/filters/in_memory_url_protocol.h"
 
+#include "media/ffmpeg/ffmpeg_common.h"
+
 namespace media {
 
 InMemoryUrlProtocol::InMemoryUrlProtocol(const uint8* data, int64 size,
@@ -17,12 +19,18 @@ InMemoryUrlProtocol::InMemoryUrlProtocol(const uint8* data, int64 size,
 InMemoryUrlProtocol::~InMemoryUrlProtocol() {}
 
 int InMemoryUrlProtocol::Read(int size, uint8* data) {
-  int available_bytes = size_ - position_;
+  if (size < 0)
+    return AVERROR(EIO);
+
+  int64 available_bytes = size_ - position_;
   if (size > available_bytes)
     size = available_bytes;
 
-  memcpy(data, data_ + position_, size);
-  position_ += size;
+  if (size > 0) {
+    memcpy(data, data_ + position_, size);
+    position_ += size;
+  }
+
   return size;
 }
 
diff --git a/media/filters/in_memory_url_protocol_unittest.cc b/media/filters/in_memory_url_protocol_unittest.cc
new file mode 100644
index 0000000..7b615cd
--- /dev/null
+++ b/media/filters/in_memory_url_protocol_unittest.cc
@@ -0,0 +1,51 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "media/ffmpeg/ffmpeg_common.h"
+#include "media/filters/in_memory_url_protocol.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace media {
+
+static const uint8 kData[] = { 0x01, 0x02, 0x03, 0x04 };
+
+TEST(InMemoryUrlProtocolTest, ReadFromLargeBuffer) {
+  InMemoryUrlProtocol protocol(kData, std::numeric_limits<int64>::max(), false);
+
+  uint8 out[sizeof(kData)];
+  EXPECT_EQ(4, protocol.Read(sizeof(out), out));
+  EXPECT_EQ(0, memcmp(out, kData, sizeof(out)));
+}
+
+TEST(InMemoryUrlProtocolTest, ReadWithNegativeSize) {
+  InMemoryUrlProtocol protocol(kData, sizeof(kData), false);
+
+  uint8 out[sizeof(kData)];
+  EXPECT_EQ(AVERROR(EIO), protocol.Read(-2, out));
+}
+
+TEST(InMemoryUrlProtocolTest, ReadWithZeroSize) {
+  InMemoryUrlProtocol protocol(kData, sizeof(kData), false);
+
+  uint8 out;
+  EXPECT_EQ(0, protocol.Read(0, &out));
+}
+
+TEST(InMemoryUrlProtocolTest, SetPosition) {
+  InMemoryUrlProtocol protocol(kData, sizeof(kData), false);
+
+  EXPECT_FALSE(protocol.SetPosition(-1));
+  EXPECT_FALSE(protocol.SetPosition(sizeof(kData) + 1));
+
+  uint8 out;
+  EXPECT_TRUE(protocol.SetPosition(sizeof(kData)));
+  EXPECT_EQ(0, protocol.Read(1, &out));
+
+  int i = sizeof(kData) / 2;
+  EXPECT_TRUE(protocol.SetPosition(i));
+  EXPECT_EQ(1, protocol.Read(1, &out));
+  EXPECT_EQ(kData[i], out);
+}
+
+}  // namespace media
diff --git a/media/media.gyp b/media/media.gyp
index 5ddaf32..3e215b1 100644
--- a/media/media.gyp
+++ b/media/media.gyp
@@ -576,6 +576,8 @@
             'filters/ffmpeg_h264_to_annex_b_bitstream_converter.h',
             'filters/ffmpeg_video_decoder.cc',
             'filters/ffmpeg_video_decoder.h',
+            'filters/in_memory_url_protocol.cc',
+            'filters/in_memory_url_protocol.h',
           ],
         }],
         ['media_use_libvpx==1', {
@@ -1040,6 +1042,7 @@
         'filters/h264_bit_reader_unittest.cc',
         'filters/h264_parser_unittest.cc',
         'filters/h264_to_annex_b_bitstream_converter_unittest.cc',
+        'filters/in_memory_url_protocol_unittest.cc',
         'filters/opus_audio_decoder_unittest.cc',
         'filters/pipeline_integration_test.cc',
         'filters/pipeline_integration_test_base.cc',
@@ -1120,6 +1123,7 @@
             'filters/ffmpeg_glue_unittest.cc',
             'filters/ffmpeg_h264_to_annex_b_bitstream_converter_unittest.cc',
             'filters/ffmpeg_video_decoder_unittest.cc',
+            'filters/in_memory_url_protocol_unittest.cc',
             'filters/opus_audio_decoder_unittest.cc',
             'filters/pipeline_integration_test.cc',
             'filters/pipeline_integration_test_base.cc',