diff --git a/media/base/rtp_utils.cc b/media/base/rtp_utils.cc
index b162fe590e..57e719b18f 100644
--- a/media/base/rtp_utils.cc
+++ b/media/base/rtp_utils.cc
@@ -287,9 +287,15 @@ bool IsRtpPacket(const void* data, size_t len) {
 // Check the RTP payload type. If 63 < payload type < 96, it's RTCP.
 // For additional details, see http://tools.ietf.org/html/rfc5761.
 bool IsRtcpPacket(const char* data, size_t len) {
-  if (len < 2) {
+  if (len < kMinRtcpPacketLen) {
     return false;
   }
+
+  // RTCP must be a valid RTP packet.
+  if ((static_cast<uint8_t>(data[0]) >> 6) != kRtpVersion) {
+    return false;
+  }
+
   char pt = data[1] & 0x7F;
   return (63 < pt) && (pt < 96);
 }
diff --git a/pc/rtp_transport_unittest.cc b/pc/rtp_transport_unittest.cc
index f3b2bb6f9f..1079ab46d6 100644
--- a/pc/rtp_transport_unittest.cc
+++ b/pc/rtp_transport_unittest.cc
@@ -293,11 +293,11 @@ TEST(RtpTransportTest, SignalDemuxedRtcp) {
   TransportObserver observer(&transport);
 
   // An rtcp packet.
-  const char data[] = {0, 73, 0, 0};
+  const unsigned char data[] = {0x80, 73, 0, 0};
   const int len = 4;
   const rtc::PacketOptions options;
   const int flags = 0;
-  fake_rtp.SendPacket(data, len, options, flags);
+  fake_rtp.SendPacket(reinterpret_cast<const char*>(data), len, options, flags);
   EXPECT_EQ(0, observer.rtp_count());
   EXPECT_EQ(1, observer.rtcp_count());
 }