admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash parsing malformed rtp packet

Browse Source 
where header extesnsion size mismatch expected.

Reland of https://codereview.webrtc.org/2067793003/

BUG=chromium:620242
R=åsapersson

Review-Url: https://codereview.webrtc.org/2060943009
Cr-Commit-Position: refs/heads/master@{#13187}
This commit is contained in:
danilchap 2016-06-17 04:18:54 -07:00 committed by Commit bot
parent 9b99499124
commit 07ec26d1a9
2 changed files with 37 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
webrtc/modules/rtp_rtcp/source/rtp_packet.cc
View File

@ -416,10 +416,13 @@ bool Packet::FindExtension(ExtensionType type,
RTC_DCHECK(offset);
for (size_t i = 0; i < num_extensions_; ++i) {
if (extension_entries_[i].type == type) {
RTC_CHECK_EQ(length, extension_entries_[i].length)
<< "Length mismatch for extension '" << type << "'"
<< "should be " << length << ", received "
<< extension_entries_[i].length;
if (length != extension_entries_[i].length) {
LOG(LS_WARNING) << "Length mismatch for extension '" << type
<< "': expected " << static_cast<int>(length)
<< ", received "
<< static_cast<int>(extension_entries_[i].length);
return false;
}
*offset = extension_entries_[i].offset;
return true;
}

30
webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc
View File

@ -31,6 +31,7 @@ constexpr int32_t kTimeOffset = 0x56ce;
constexpr bool kVoiceActive = true;
constexpr uint8_t kAudioLevel = 0x5a;
constexpr size_t kMaxPaddingSize = 224u;
// clang-format off
constexpr uint8_t kMinimumPacket[] = {
0x80, kPayloadType, 0x00, kSeqNum,
0x65, 0x43, 0x12, 0x78,
@ -64,6 +65,17 @@ constexpr uint8_t kPacket[] = {
'p', 'a', 'y', 'l', 'o', 'a', 'd',
'p', 'a', 'd', 'd', 'i', 'n', 'g', kPacketPaddingSize};
constexpr uint8_t kPacketWithInvalidExtension[] = {
0x90, kPayloadType, 0x00, kSeqNum,
0x65, 0x43, 0x12, 0x78, // kTimestamp.
0x12, 0x34, 0x56, 0x78, // kSSrc.
0xbe, 0xde, 0x00, 0x02, // Extension block of size 2 x 32bit words.
(kTransmissionOffsetExtensionId << 4) | 6, // (6+1)-byte extension, but
'e', 'x', 't', // Transmission Offset
'd', 'a', 't', 'a', // expected to be 3-bytes.
'p', 'a', 'y', 'l', 'o', 'a', 'd'
};
// clang-format on
} // namespace
TEST(RtpPacketTest, CreateMinimum) {
@ -193,6 +205,24 @@ TEST(RtpPacketTest, ParseWithExtension) {
EXPECT_EQ(0u, packet.padding_size());
}
TEST(RtpPacketTest, ParseWithInvalidSizedExtension) {
RtpPacketToSend::ExtensionManager extensions;
extensions.Register(kRtpExtensionTransmissionTimeOffset,
kTransmissionOffsetExtensionId);
RtpPacketReceived packet(&extensions);
EXPECT_TRUE(packet.Parse(kPacketWithInvalidExtension,
sizeof(kPacketWithInvalidExtension)));
// Extension should be ignored.
int32_t time_offset;
EXPECT_FALSE(packet.GetExtension<TransmissionOffset>(&time_offset));
// But shouldn't prevent reading payload.
EXPECT_THAT(make_tuple(packet.payload(), packet.payload_size()),
ElementsAreArray(kPayload));
}
TEST(RtpPacketTest, ParseWith2Extensions) {
RtpPacketToSend::ExtensionManager extensions;
extensions.Register(kRtpExtensionTransmissionTimeOffset,