This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please see the following link for instructions on filing security bugs:
http://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Currently, this bug is NOT exploitable due a ffmpeg's checking in avformat_find_stream_info and an OOM error before the actual vulnerability, i'm posting it under "security" because that I'm not sure if that's right for all of chromium's configurations. 

VULNERABILITY DETAILS
An integer overflow in a signed variable "sample_count_sum" in TrackRunIterator::Init
that later gets used as a parameter to an input iterator.

int sample_count_sum = 0;

[code from https://cs.chromium.org/chromium/src/media/formats/mp4/track_run_iterator.cc?rcl=0&l=360]
tri.aux_info_sizes.insert(
	tri.aux_info_sizes.begin(), 
	sizes.begin() 
		+ sample_count_sum, // sample_count_sum is user controlled.
	sizes.begin() 
		+ sample_count_sum 
		+ trun.sample_count); // trun.sample_count is user controlled.
[/code]

[code from https://cs.chromium.org/chromium/src/media/formats/mp4/track_run_iterator.cc?q=TrackRunIterator::Init&sq=package:chromium&dr=CSs&l=420]
sample_count_sum += trun.sample_count; // integer overflow here, 
                                       // trun.sample_count is user controlled.
[/code]

However, the program probably die from OOB before running this code because that an exploit will require a trun.sample_count bytes file.

VERSION
Chrome Version: 53.0.2785.92, stable.
Operating System: Arch Linux.

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace, registers, exception record]
Client ID (if relevant): [see link above]

NOTES:
	1: None of the values that get read in box_definition.cc 
	   get validated as they should. That gave me as an attacker
	   a lot of flexibility and may create many more security bugs.