Fixing integer overflow when parsing bandwidth attribute.

webrtc/api/webrtcsdp_unittest.cc

 /*
  *  Copyright 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 3183 matching lines @@
       "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
       "s=-\r\n"
       "t=0 0\r\n"
       "m=video 9 UDP/DTLS/SCTP 120\r\n"
       "a=sctp-port 5000\r\n"
       "a=fmtp:108 foo=10\r\n";
 
   ExpectParseFailure(std::string(kSdpWithSctpPortInVideoDescription),
                      "sctp-port");
 }
+
+// Regression test for integer overflow bug:
+// https://bugs.chromium.org/p/chromium/issues/detail?id=648071
+TEST_F(WebRtcSdpTest, DeserializeLargeBandwidthLimit) {
+  JsepSessionDescription jdesc_output(kDummyString);
+
+  // Bandwidth attribute is the max signed 32-bit int, which will get
+  // multiplied by 1000 and cause int overflow if not careful.
+  const char kSdpWithLargeBandwidth[] =
+      "v=0\r\n"
+      "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
+      "s=-\r\n"
+      "t=0 0\r\n"
+      "m=video 3457 RTP/SAVPF 120\r\n"
+      "b=AS:2147483647\r\n"
+      "foo=fail\r\n";
+
+  ExpectParseFailure(std::string(kSdpWithLargeBandwidth), "foo=fail");
+}