From 978af6000f4fe42915a3898bbac4d304b4f556a9 Mon Sep 17 00:00:00 2001
From: Simeon Anfinrud <[email protected]>
Date: Wed, 06 May 2026 13:23:45 -0700
Subject: [PATCH] [chromecast] Fix Chromecast Mixer Service Heap Out-of-Bounds Read via Channel Layout Mismatch

Adds validation between the requested channel count and channel layout
during stream creation in MixerInputConnection, and validates input
channel count matches output channel count in InterleavedChannelMixer.

Bug: 502473563
Test: Compiled and passed unit tests.
Change-Id: If398d672e1b30b8fb5888e363fb4159321bdb3a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7765506
Auto-Submit: Simeon Anfinrud <[email protected]>
Reviewed-by: Sandeep Vijayasekar <[email protected]>
Commit-Queue: Simeon Anfinrud <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1626412}
---

diff --git a/chromecast/media/audio/interleaved_channel_mixer.cc b/chromecast/media/audio/interleaved_channel_mixer.cc
index 5f58c972..637d50c 100644
--- a/chromecast/media/audio/interleaved_channel_mixer.cc
+++ b/chromecast/media/audio/interleaved_channel_mixer.cc
@@ -22,7 +22,8 @@
       output_layout_(output_layout),
       output_channel_count_(output_channel_count),
       max_frames_(max_frames) {
-  if (input_layout_ == output_layout_) {
+  if (input_layout_ == output_layout_ &&
+      input_channel_count_ == output_channel_count_) {
     return;
   }
 
@@ -44,7 +45,8 @@
 InterleavedChannelMixer::~InterleavedChannelMixer() = default;
 
 float* InterleavedChannelMixer::Transform(const float* input, int num_frames) {
-  if (input_layout_ == output_layout_) {
+  if (input_layout_ == output_layout_ &&
+      input_channel_count_ == output_channel_count_) {
     return const_cast<float*>(input);
   }
 
diff --git a/chromecast/media/cma/backend/mixer/mixer_input_connection.cc b/chromecast/media/cma/backend/mixer/mixer_input_connection.cc
index 17637e8..0b30a27 100644
--- a/chromecast/media/cma/backend/mixer/mixer_input_connection.cc
+++ b/chromecast/media/cma/backend/mixer/mixer_input_connection.cc
@@ -421,6 +421,18 @@
   DCHECK(socket_);
   CHECK_GT(num_channels_, 0);
   CHECK_GT(input_samples_per_second_, 0);
+  if (channel_layout_ != ::media::CHANNEL_LAYOUT_DISCRETE &&
+      ::media::ChannelLayoutToChannelCount(channel_layout_) != num_channels_) {
+    LOG(ERROR) << "Invalid channel layout/count: " << channel_layout_ << " / "
+               << num_channels_;
+    // Setting state_ to kRemoved or setting a flag might be needed.
+    // Instead we can just CHECK, but it might be untrusted renderer input.
+    // However, since it's a constructor, we can just let it fail gracefully
+    // later or here we just set a flag. Or we can just CHECK to fail safe if
+    // the renderer is compromised anyway.
+    CHECK_EQ(::media::ChannelLayoutToChannelCount(channel_layout_),
+             num_channels_);
+  }
   DCHECK_LE(start_threshold_frames_, max_queued_frames_);
 
   socket_->SetDelegate(this);