Commit b838150f authored by Becca Hughes's avatar Becca Hughes Committed by Commit Bot

[Media Controls] Fix integer cast

MediaControlSliderElement is causing a ClusterFuzz error
because we are casting a float to an int that could
overflow.

BUG=852364

Change-Id: Ic454a79ebf6ef8d40f85e054a70cb87030c6db9c
Reviewed-on: https://chromium-review.googlesource.com/1131921
Commit-Queue: Becca Hughes <beccahughes@chromium.org>
Reviewed-by: default avatarMounir Lamouri <mlamouri@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574191}
parent 46629048
......@@ -21,8 +21,9 @@ void SetSegmentDivPosition(blink::HTMLDivElement* segment,
blink::MediaControlSliderElement::Position position,
int width,
float zoom_factor) {
int segment_width = int((position.width * width) / zoom_factor);
int segment_left = int((position.left * width) / zoom_factor);
int segment_width =
clampTo<int>(floor((position.width * width) / zoom_factor));
int segment_left = clampTo<int>(floor((position.left * width) / zoom_factor));
int current_width = 0;
int current_left = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment