From 53f1fe4ff6c8256ec388506914c039d6245e9181 Mon Sep 17 00:00:00 2001
From: Danil Chapovalov <danilchap@webrtc.org>
Date: Mon, 28 Jun 2021 11:43:52 +0200
Subject: [PATCH] Fail instead of crashing while writing invalid dependency
 descriptor

Bug: webrtc:10342
Change-Id: Ic9af7913aa9835450877940fc5cf29bebf774484
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/224082
Reviewed-by: Emil Lundmark <lndmrk@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#34379}
---
 ...dependency_descriptor_extension_unittest.cc | 18 ++++++++++++++++++
 .../source/rtp_dependency_descriptor_writer.cc | 11 ++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/modules/rtp_rtcp/source/rtp_dependency_descriptor_extension_unittest.cc b/modules/rtp_rtcp/source/rtp_dependency_descriptor_extension_unittest.cc
index 11d809693c..974557ce6e 100644
--- a/modules/rtp_rtcp/source/rtp_dependency_descriptor_extension_unittest.cc
+++ b/modules/rtp_rtcp/source/rtp_dependency_descriptor_extension_unittest.cc
@@ -115,5 +115,23 @@ TEST(RtpDependencyDescriptorExtensionTest,
       buffer, structure, active_chains, descriptor));
 }
 
+TEST(RtpDependencyDescriptorExtensionTest, FailsToWriteInvalidDescriptor) {
+  uint8_t buffer[256];
+  FrameDependencyStructure structure;
+  structure.num_decode_targets = 2;
+  structure.num_chains = 2;
+  structure.templates = {
+      FrameDependencyTemplate().T(0).Dtis("SR").ChainDiffs({2, 2})};
+  DependencyDescriptor descriptor;
+  descriptor.frame_dependencies = structure.templates[0];
+  descriptor.frame_dependencies.temporal_id = 1;
+
+  EXPECT_EQ(
+      RtpDependencyDescriptorExtension::ValueSize(structure, 0b11, descriptor),
+      0u);
+  EXPECT_FALSE(RtpDependencyDescriptorExtension::Write(buffer, structure, 0b11,
+                                                       descriptor));
+}
+
 }  // namespace
 }  // namespace webrtc
diff --git a/modules/rtp_rtcp/source/rtp_dependency_descriptor_writer.cc b/modules/rtp_rtcp/source/rtp_dependency_descriptor_writer.cc
index 25d221253b..31df783064 100644
--- a/modules/rtp_rtcp/source/rtp_dependency_descriptor_writer.cc
+++ b/modules/rtp_rtcp/source/rtp_dependency_descriptor_writer.cc
@@ -66,6 +66,9 @@ RtpDependencyDescriptorWriter::RtpDependencyDescriptorWriter(
 }
 
 bool RtpDependencyDescriptorWriter::Write() {
+  if (build_failed_) {
+    return false;
+  }
   WriteMandatoryFields();
   if (HasExtendedFields()) {
     WriteExtendedFields();
@@ -83,6 +86,9 @@ bool RtpDependencyDescriptorWriter::Write() {
 }
 
 int RtpDependencyDescriptorWriter::ValueSizeBits() const {
+  if (build_failed_) {
+    return 0;
+  }
   static constexpr int kMandatoryFields = 1 + 1 + 6 + 16;
   int value_size_bits = kMandatoryFields + best_template_.extra_size_bits;
   if (HasExtendedFields()) {
@@ -172,7 +178,10 @@ void RtpDependencyDescriptorWriter::FindBestTemplate() {
                frame_template.temporal_id;
   };
   auto first = absl::c_find_if(templates, same_layer);
-  RTC_CHECK(first != templates.end());
+  if (first == templates.end()) {
+    build_failed_ = true;
+    return;
+  }
   auto last = std::find_if_not(first, templates.end(), same_layer);
 
   best_template_ = CalculateMatch(first);