Code: static bool CheckMov(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size > 8);
 
   int offset = 0;
   while (offset + 8 < buffer_size) {
    int atomsize = Read32(buffer + offset);
     uint32 atomtype = Read32(buffer + offset + 4);
     switch (atomtype) {
      case TAG('f','t','y','p'):
      case TAG('p','d','i','n'):
      case TAG('m','o','o','v'):
      case TAG('m','o','o','f'):
      case TAG('m','f','r','a'):
      case TAG('m','d','a','t'):
      case TAG('f','r','e','e'):
      case TAG('s','k','i','p'):
      case TAG('m','e','t','a'):
      case TAG('m','e','c','o'):
      case TAG('s','t','y','p'):
      case TAG('s','i','d','x'):
      case TAG('s','s','i','x'):
      case TAG('p','r','f','t'):
      case TAG('b','l','o','c'):
        break;
      default:
        return false;
    }
    if (atomsize == 1) {
      if (offset + 16 > buffer_size)
        break;
      if (Read32(buffer + offset + 8) != 0)
         break;  // Offset is way past buffer size.
       atomsize = Read32(buffer + offset + 12);
     }
    if (atomsize <= 0)
       break;  // Indicates the last atom or length too big.
     offset += atomsize;
   }
  return true;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-189
Summary: Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.
Commit Message: Add extra checks to avoid integer overflow.

BUG=425980
TEST=no crash with ASAN

Review URL: https://codereview.chromium.org/659743004

Cr-Commit-Position: refs/heads/master@{#301249}