From da336c5aa47ab740c17d23e1fc63a19d5ad7888c Mon Sep 17 00:00:00 2001
From: Jean-Yves Avenard <jyavenard@mozilla.com>
Date: Wed, 1 May 2019 23:13:34 +0000
Subject: [PATCH] Bug 1532849 - Prevent arithmetic overflow. r=bryce

Differential Revision: https://phabricator.services.mozilla.com/D29461

--HG--
extra : moz-landing-system : lando
---
 dom/media/ChannelMediaDecoder.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/media/ChannelMediaDecoder.cpp b/dom/media/ChannelMediaDecoder.cpp
index 99c57130f308..b732d1ae4626 100644
--- a/dom/media/ChannelMediaDecoder.cpp
+++ b/dom/media/ChannelMediaDecoder.cpp
@@ -410,7 +410,8 @@ ChannelMediaDecoder::ComputePlaybackRate(const MediaChannelStatistics& aStats,
   MOZ_ASSERT(!NS_IsMainThread());
 
   int64_t length = aResource->GetLength();
-  if (mozilla::IsFinite<double>(aDuration) && aDuration > 0 && length >= 0) {
+  if (mozilla::IsFinite<double>(aDuration) && aDuration > 0 && length >= 0 &&
+      length / aDuration < UINT32_MAX) {
     return {uint32_t(length / aDuration), true};
   }