commit b762b5b794f49f5986dd83c50c81b7e5a57a8411
author Per Kjellander <perkj@webrtc.org> Tue Jun 18 14:59:04 2019
committer Commit Bot <commit-bot@chromium.org> Tue Jun 18 15:42:54 2019
tree d15377ec8e01e104be5cee98d14067fa00647850
parent 342f98b117653524dc08f585fd5053ceca5b4d40

Fix potential signed overflow in IntervalBudget::set_target_rate_kbps

This methods multiplies an int with 500. This cl ensure that does not overflow.

BUG=none

Change-Id: I2c4c4c169baf3bbc2cac021e87e396c605cd1815
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/141860
Commit-Queue: Per Kjellander <perkj@webrtc.org>
Reviewed-by: Sebastian Jansson <srte@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#28310}

modules/pacing/interval_budget.cc

diff --git a/modules/pacing/interval_budget.cc b/modules/pacing/interval_budget.cc
index 9fe0563..321ca46 100644
--- a/modules/pacing/interval_budget.cc
+++ b/modules/pacing/interval_budget.cc
@@ -16,7 +16,7 @@
 
 namespace webrtc {
 namespace {
-constexpr int kWindowMs = 500;
+constexpr int64_t kWindowMs = 500;
 }
 
 IntervalBudget::IntervalBudget(int initial_target_rate_kbps)
@@ -36,7 +36,7 @@
 }
 
 void IntervalBudget::IncreaseBudget(int64_t delta_time_ms) {
-  int bytes = rtc::dchecked_cast<int>(target_rate_kbps_ * delta_time_ms / 8);
+  int64_t bytes = target_rate_kbps_ * delta_time_ms / 8;
   if (bytes_remaining_ < 0 || can_build_up_underuse_) {
     // We overused last interval, compensate this interval.
     bytes_remaining_ = std::min(bytes_remaining_ + bytes, max_bytes_in_budget_);
@@ -52,7 +52,7 @@
 }
 
 size_t IntervalBudget::bytes_remaining() const {
-  return static_cast<size_t>(std::max(0, bytes_remaining_));
+  return rtc::saturated_cast<size_t>(std::max<int64_t>(0, bytes_remaining_));
 }
 
 double IntervalBudget::budget_ratio() const {

modules/pacing/interval_budget.h

diff --git a/modules/pacing/interval_budget.h b/modules/pacing/interval_budget.h
index 43f3867..faeb1d8 100644
--- a/modules/pacing/interval_budget.h
+++ b/modules/pacing/interval_budget.h
@@ -34,8 +34,8 @@
 
  private:
   int target_rate_kbps_;
-  int max_bytes_in_budget_;
-  int bytes_remaining_;
+  int64_t max_bytes_in_budget_;
+  int64_t bytes_remaining_;
   bool can_build_up_underuse_;
 };