admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash parsing malformed rtp packet

Browse Source 
where header extesnsion size mismatch expected.

BUG=chromium:620242
R=asapersson@webrtc.org

Review URL: https://codereview.webrtc.org/2067793003 .

Cr-Commit-Position: refs/heads/master@{#13170}
This commit is contained in:
Danil Chapovalov 2016-06-16 18:52:37 +02:00
parent 4867ca2689
commit 5a45fe6fd7
2 changed files with 39 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
webrtc/modules/rtp_rtcp/source/rtp_packet.cc
View File

@ -416,10 +416,13 @@ bool Packet::FindExtension(ExtensionType type,
RTC_DCHECK(offset);
for (size_t i = 0; i < num_extensions_; ++i) {
if (extension_entries_[i].type == type) {
RTC_CHECK_EQ(length, extension_entries_[i].length)
<< "Length mismatch for extension '" << type << "'"
<< "should be " << length << ", received "
<< extension_entries_[i].length;
if (length != extension_entries_[i].length) {
LOG(LS_WARNING) << "Length mismatch for extension '" << type
<< "': expected " << static_cast<int>(length)
<< ", received "
<< static_cast<int>(extension_entries_[i].length);
return false;
}
*offset = extension_entries_[i].offset;
return true;
}

33
webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc
View File

@ -31,6 +31,7 @@ constexpr int32_t kTimeOffset = 0x56ce;
constexpr bool kVoiceActive = true;
constexpr uint8_t kAudioLevel = 0x5a;
constexpr size_t kMaxPaddingSize = 224u;
// clang-format off
constexpr uint8_t kMinimumPacket[] = {
0x80, kPayloadType, 0x00, kSeqNum,
0x65, 0x43, 0x12, 0x78,
@ -63,7 +64,7 @@ constexpr uint8_t kPacket[] = {
0x12, 0x00, 0x56, 0xce,
'p', 'a', 'y', 'l', 'o', 'a', 'd',
'p', 'a', 'd', 'd', 'i', 'n', 'g', kPacketPaddingSize};
// clang-format on
} // namespace
TEST(RtpPacketTest, CreateMinimum) {
@ -193,6 +194,36 @@ TEST(RtpPacketTest, ParseWithExtension) {
EXPECT_EQ(0u, packet.padding_size());
}
TEST(RtpPacketTest, ParseWithInvalidSizedExtension) {
// clang-format off
constexpr uint8_t kBadPacket[] = {
0x90, kPayloadType, 0x00, kSeqNum,
0x65, 0x43, 0x12, 0x78, // kTimestamp.
0x12, 0x34, 0x56, 0x78, // kSSrc.
0xbe, 0xde, 0x00, 0x02, // Extension block of size 2 x 32bit words.
(kTransmissionOffsetExtensionId << 4) | 6, // (6+1)-byte extension, but
'e', 'x', 't', // Transmission Offset
'd', 'a', 't', 'a', // expected to be 3-bytes.
'p', 'a', 'y', 'l', 'o', 'a', 'd',
};
// clang-format on
RtpPacketToSend::ExtensionManager extensions;
extensions.Register(kRtpExtensionTransmissionTimeOffset,
kTransmissionOffsetExtensionId);
RtpPacketReceived packet(&extensions);
EXPECT_TRUE(packet.Parse(kBadPacket, sizeof(kBadPacket)));
// Extension should be ignored.
int32_t time_offset;
EXPECT_FALSE(packet.GetExtension<TransmissionOffset>(&time_offset));
// But shouldn't prevent reading payload.
EXPECT_THAT(make_tuple(packet.payload(), packet.payload_size()),
ElementsAreArray(kPayload));
}
TEST(RtpPacketTest, ParseWith2Extensions) {
RtpPacketToSend::ExtensionManager extensions;
extensions.Register(kRtpExtensionTransmissionTimeOffset,