Avoid overflow in checking for emulation bytes in rbsp.

webrtc/modules/rtp_rtcp/source/h264_sps_parser.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 18 matching lines @@
   // General note: this is based off the 02/2014 version of the H.264 standard.
   // You can find it on this page:
   // http://www.itu.int/rec/T-REC-H.264
 
   const char* sps_bytes = reinterpret_cast<const char*>(sps_);
   // First, parse out rbsp, which is basically the source buffer minus emulation
   // bytes (the last byte of a 0x00 0x00 0x03 sequence). RBSP is defined in
   // section 7.3.1 of the H.264 standard.
   rtc::ByteBuffer rbsp_buffer;
   for (size_t i = 0; i < byte_length_;) {
-    if (i + 3 < byte_length_ && sps_[i] == 0 && sps_[i + 1] == 0 &&
+    // Be careful about over/underflow here. byte_length_ - 3 can underflow, and
+    // i + 3 can overflow, but byte_length_ - i can't, because i < byte_length_
+    // above, and that expression will produce the number of bytes left in
+    // the stream including the byte at i.
+    if (byte_length_ - i >= 3 && sps_[i] == 0 && sps_[i + 1] == 0 &&
         sps_[i + 2] == 3) {
       // Two rbsp bytes + the emulation byte.
       rbsp_buffer.WriteBytes(sps_bytes + i, 2);
       i += 3;
     } else {
       // Single rbsp byte.
       rbsp_buffer.WriteBytes(sps_bytes + i, 1);
       i++;
     }
   }
@@ skipping 169 matching lines @@
   // Subtract the crop for each dimension.
   width -= (frame_crop_left_offset + frame_crop_right_offset);
   height -= (frame_crop_top_offset + frame_crop_bottom_offset);
 
   width_ = width;
   height_ = height;
   return true;
 }
 
 }  // namespace webrtc