diff --git a/media/base/mac/channel_layout_util_mac.cc b/media/base/mac/channel_layout_util_mac.cc
index 5c9d3c68286c8..689fa2da35400 100644
--- a/media/base/mac/channel_layout_util_mac.cc
+++ b/media/base/mac/channel_layout_util_mac.cc
@@ -11,6 +11,7 @@
 #include "base/compiler_specific.h"
 #include "base/containers/span.h"
 #include "media/base/channel_layout.h"
+#include "media/base/limits.h"
 
 namespace media {
 
@@ -110,13 +111,18 @@ std::unique_ptr<ScopedAudioChannelLayout> ChannelLayoutToAudioChannelLayout(
     int input_channels) {
   CHECK_GT(input_layout, CHANNEL_LAYOUT_UNSUPPORTED);
   CHECK_GT(input_channels, 0);
+  // `input_channels` may originate from a renderer-influenced
+  // AudioStreamBasicDescription.mChannelsPerFrame; bound it before it is used
+  // to size the HeapArray below to avoid size_t->int truncation and the
+  // resulting undersized allocation + OOB span writes.
+  CHECK_LE(input_channels, limits::kMaxChannels);
 
   // AudioChannelLayout is structure ending in a variable length array, so we
   // can't directly allocate one.
   //
   // Code modeled after example from Apple documentation here:
   // https://developer.apple.com/library/content/qa/qa1627/_index.html
-  int output_layout_size =
+  size_t output_layout_size =
       offsetof(AudioChannelLayout, mChannelDescriptions[input_channels]);
   auto new_layout =
       std::make_unique<ScopedAudioChannelLayout>(output_layout_size);