Fixing integer overflow when parsing bandwidth attribute.

webrtc/api/webrtcsdp.cc

 /*
  *  Copyright 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 2579 matching lines @@
           // data channels. Don't allow SDP to set the bandwidth, because
           // that would give JS the opportunity to "break the Internet".
           // See: https://code.google.com/p/chromium/issues/detail?id=280726
           if (media_type == cricket::MEDIA_TYPE_DATA && IsRtp(protocol) &&
               b > cricket::kDataMaxBandwidth / 1000) {
             std::ostringstream description;
             description << "RTP-based data channels may not send more than "
                         << cricket::kDataMaxBandwidth / 1000 << "kbps.";
             return ParseFailed(line, description.str(), error);
           }
-          media_desc->set_bandwidth(b * 1000);
+          // Prevent integer overflow.
+          media_desc->set_bandwidth(b < INT_MAX / 1000 ? b * 1000 : INT_MAX);

[pthatcher1, 2016/12/13 23:58:05]

Can you put a paren around the thing before "?"?  Thanks.    That would just
make it a bit easier to read.  

Actually, this might be even a bit easier to read:

int max_b = INT_MAX/1000; 
if (b > max_b) {
  b = max_b;
}
media_desc->set_bandwidth(b * 1000);

[Taylor Brandstetter, 2016/12/14 00:17:01]

Done (but using std::min).

         }
       }
       continue;
     }
 
     if (!IsLineType(line, kLineTypeAttributes)) {
       // TODO: Handle other lines if needed.
       LOG(LS_INFO) << "Ignored line: " << line;
       continue;
     }
@@ skipping 562 matching lines @@
     UpdateCodec<AudioContentDescription, cricket::AudioCodec>(
         media_desc, payload_type, feedback_param);
   } else if (media_type == cricket::MEDIA_TYPE_VIDEO) {
     UpdateCodec<VideoContentDescription, cricket::VideoCodec>(
         media_desc, payload_type, feedback_param);
   }
   return true;
 }
 
 }  // namespace webrtc