Code:  void BlobURLRequestJob::CountSize() {
   error_ = false;
   pending_get_file_info_count_ = 0;
  total_size_ = 0;
  item_length_list_.resize(blob_data_->items().size());

  for (size_t i = 0; i < blob_data_->items().size(); ++i) {
    const BlobData::Item& item = blob_data_->items().at(i);
    if (IsFileType(item.type())) {
      ++pending_get_file_info_count_;
      GetFileStreamReader(i)->GetLength(
          base::Bind(&BlobURLRequestJob::DidGetFileItemLength,
                      weak_factory_.GetWeakPtr(), i));
       continue;
     }
    int64 item_length = static_cast<int64>(item.length());
    item_length_list_[i] = item_length;
    total_size_ += item_length;
   }
 
   if (pending_get_file_info_count_ == 0)
    DidCountSize(net::OK);
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-189
Summary: Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob.
Commit Message: Avoid integer overflows in BlobURLRequestJob.

BUG=169685


Review URL: https://chromiumcodereview.appspot.com/12047012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@179154 0039d316-1c4b-4281-b951-d872f2087c98