Fix integer overflow in WebRtc_CreateBuffer

Added a check to ensure element_count * element_size does not overflow
size_t. Subsequent writes to the buffer could result in out-of-bounds
heap writes if the multiplication wraps around to a small number.

Bug: None
Change-Id: I0a37dfdf19fcee8b19765e8aec316d0886876d09
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/456460
Commit-Queue: Fredrik Solenberg <solenberg@webrtc.org>
Reviewed-by: Per Åhgren <peah@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47164}

common_audio/ring_buffer.c

diff --git a/common_audio/ring_buffer.c b/common_audio/ring_buffer.c
index a3fabd0..c7ff782 100644
--- a/common_audio/ring_buffer.c
+++ b/common_audio/ring_buffer.c
@@ -14,6 +14,7 @@
 #include "common_audio/ring_buffer.h"
 
 #include <stddef.h>  // size_t
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -56,6 +57,10 @@
     return NULL;
   }
 
+  if (element_count > SIZE_MAX / element_size) {
+    return NULL;
+  }
+
   self = malloc(sizeof(RingBuffer));
   if (!self) {
     return NULL;

common_audio/ring_buffer_unittest.cc

diff --git a/common_audio/ring_buffer_unittest.cc b/common_audio/ring_buffer_unittest.cc
index f93f042..a87de9d 100644
--- a/common_audio/ring_buffer_unittest.cc
+++ b/common_audio/ring_buffer_unittest.cc
@@ -11,6 +11,7 @@
 #include "common_audio/ring_buffer.h"
 
 #include <algorithm>
+#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <ctime>
@@ -142,6 +143,8 @@
 TEST(RingBufferTest, CreateHandlesErrors) {
   EXPECT_TRUE(WebRtc_CreateBuffer(0, 1) == nullptr);
   EXPECT_TRUE(WebRtc_CreateBuffer(1, 0) == nullptr);
+  EXPECT_TRUE(WebRtc_CreateBuffer(SIZE_MAX, 2) == nullptr);
+  EXPECT_TRUE(WebRtc_CreateBuffer(2, SIZE_MAX) == nullptr);
   RingBuffer* buffer = WebRtc_CreateBuffer(1, 1);
   EXPECT_TRUE(buffer != nullptr);
   WebRtc_FreeBuffer(buffer);