From 23914fe756903353eae13fffc868d2c84f51f06f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Bostr=C3=B6m?= Date: Tue, 31 Mar 2015 15:08:04 +0200 Subject: [PATCH] Reject RTP one-byte extension ID 0. Only accept local identifiers in the range 1-14 inclusive. BUG=1788, chromium:471328 R=asapersson@webrtc.org Review URL: https://webrtc-codereview.appspot.com/50549004 Cr-Commit-Position: refs/heads/master@{#8900} --- talk/media/webrtc/webrtcvideoengine2.cc | 2 +- talk/media/webrtc/webrtcvideoengine2_unittest.cc | 4 ++-- webrtc/video/video_receive_stream.cc | 3 +++ webrtc/video/video_send_stream.cc | 3 +++ 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/talk/media/webrtc/webrtcvideoengine2.cc b/talk/media/webrtc/webrtcvideoengine2.cc index 458c619381..c9781a7498 100644 --- a/talk/media/webrtc/webrtcvideoengine2.cc +++ b/talk/media/webrtc/webrtcvideoengine2.cc @@ -189,7 +189,7 @@ static bool ValidateRtpHeaderExtensionIds( const std::vector& extensions) { std::set extensions_used; for (size_t i = 0; i < extensions.size(); ++i) { - if (extensions[i].id < 0 || extensions[i].id >= 15 || + if (extensions[i].id <= 0 || extensions[i].id >= 15 || !extensions_used.insert(extensions[i].id).second) { LOG(LS_ERROR) << "RTP extensions are with incorrect or duplicate ids."; return false; diff --git a/talk/media/webrtc/webrtcvideoengine2_unittest.cc b/talk/media/webrtc/webrtcvideoengine2_unittest.cc index ba7eb2313e..cbf516dd78 100644 --- a/talk/media/webrtc/webrtcvideoengine2_unittest.cc +++ b/talk/media/webrtc/webrtcvideoengine2_unittest.cc @@ -1301,7 +1301,7 @@ TEST_F(WebRtcVideoChannel2Test, } TEST_F(WebRtcVideoChannel2Test, SetSendRtpHeaderExtensionsRejectsIncorrectIds) { - const int kIncorrectIds[] = {-2, -1, 15, 16}; + const int kIncorrectIds[] = {-2, -1, 0, 15, 16}; for (size_t i = 0; i < arraysize(kIncorrectIds); ++i) { std::vector extensions; extensions.push_back(cricket::RtpHeaderExtension( @@ -1312,7 +1312,7 @@ TEST_F(WebRtcVideoChannel2Test, SetSendRtpHeaderExtensionsRejectsIncorrectIds) { } TEST_F(WebRtcVideoChannel2Test, SetRecvRtpHeaderExtensionsRejectsIncorrectIds) { - const int kIncorrectIds[] = {-2, -1, 15, 16}; + const int kIncorrectIds[] = {-2, -1, 0, 15, 16}; for (size_t i = 0; i < arraysize(kIncorrectIds); ++i) { std::vector extensions; extensions.push_back(cricket::RtpHeaderExtension( diff --git a/webrtc/video/video_receive_stream.cc b/webrtc/video/video_receive_stream.cc index 88e5be9de3..126d485e58 100644 --- a/webrtc/video/video_receive_stream.cc +++ b/webrtc/video/video_receive_stream.cc @@ -174,6 +174,9 @@ VideoReceiveStream::VideoReceiveStream(webrtc::VideoEngine* video_engine, for (size_t i = 0; i < config_.rtp.extensions.size(); ++i) { const std::string& extension = config_.rtp.extensions[i].name; int id = config_.rtp.extensions[i].id; + // One-byte-extension local identifiers are in the range 1-14 inclusive. + DCHECK_GE(id, 1); + DCHECK_LE(id, 14); if (extension == RtpExtension::kTOffset) { CHECK_EQ(0, rtp_rtcp_->SetReceiveTimestampOffsetStatus(channel_, true, id)); diff --git a/webrtc/video/video_send_stream.cc b/webrtc/video/video_send_stream.cc index 4e1e129e87..9949f5017e 100644 --- a/webrtc/video/video_send_stream.cc +++ b/webrtc/video/video_send_stream.cc @@ -131,6 +131,9 @@ VideoSendStream::VideoSendStream( for (size_t i = 0; i < config_.rtp.extensions.size(); ++i) { const std::string& extension = config_.rtp.extensions[i].name; int id = config_.rtp.extensions[i].id; + // One-byte-extension local identifiers are in the range 1-14 inclusive. + DCHECK_GE(id, 1); + DCHECK_LE(id, 14); if (extension == RtpExtension::kTOffset) { CHECK_EQ(0, rtp_rtcp_->SetSendTimestampOffsetStatus(channel_, true, id)); } else if (extension == RtpExtension::kAbsSendTime) {