admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix infinite loop in rtp packet parsing

Browse Source 
when rtp header extension is larger than 2^16 bytes

Bug: chromium:811613
Change-Id: I05b725d734dd628056d603b596d3523e827ddb54
Reviewed-on: https://webrtc-review.googlesource.com/52345
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Reviewed-by: Alex Loiko <aleloi@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#22003}
This commit is contained in:
Danil Chapovalov 2018-02-13 13:55:30 +01:00 committed by Commit Bot
parent fdd4400ef4
commit 61405bcb19
3 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
modules/rtp_rtcp/source/rtp_packet.cc
View File

@ -336,10 +336,11 @@ rtc::ArrayView<uint8_t> RtpPacket::AllocateRawExtension(int id, size_t length) {
extension_entry->offset = rtc::dchecked_cast<uint16_t>( extension_entry->offset = rtc::dchecked_cast<uint16_t>(
extensions_offset + extensions_size_ + kOneByteHeaderSize); extensions_offset + extensions_size_ + kOneByteHeaderSize);
extension_entry->length = rtc::dchecked_cast<uint8_t>(length); extension_entry->length = rtc::dchecked_cast<uint8_t>(length);
extensions_size_ = rtc::dchecked_cast<uint16_t>(new_extensions_size); extensions_size_ = new_extensions_size;
// Update header length field. // Update header length field.
uint16_t extensions_words = (extensions_size_ + 3) / 4; // Wrap up to 32bit. uint16_t extensions_words = rtc::dchecked_cast<uint16_t>(
(extensions_size_ + 3) / 4); // Wrap up to 32bit.
ByteWriter<uint16_t>::WriteBigEndian(WriteAt(extensions_offset - 2), ByteWriter<uint16_t>::WriteBigEndian(WriteAt(extensions_offset - 2),
extensions_words); extensions_words);
// Fill extension padding place with zeroes. // Fill extension padding place with zeroes.

2
modules/rtp_rtcp/source/rtp_packet.h
View File

@ -157,7 +157,7 @@ class RtpPacket {
size_t payload_size_; size_t payload_size_;
ExtensionInfo extension_entries_[kMaxExtensionHeaders]; ExtensionInfo extension_entries_[kMaxExtensionHeaders];
uint16_t extensions_size_ = 0; // Unaligned. size_t extensions_size_ = 0; // Unaligned.
rtc::CopyOnWriteBuffer buffer_; rtc::CopyOnWriteBuffer buffer_;
}; };

BIN
test/fuzzers/corpora/rtp-corpus/rtp-6 Normal file
View File

Binary file not shown.