diff --git a/modules/rtp_rtcp/source/forward_error_correction_internal.cc b/modules/rtp_rtcp/source/forward_error_correction_internal.cc index 7336331b49..7e5fd91e03 100644 --- a/modules/rtp_rtcp/source/forward_error_correction_internal.cc +++ b/modules/rtp_rtcp/source/forward_error_correction_internal.cc @@ -498,6 +498,8 @@ void CopyColumn(uint8_t* new_mask, int num_fec_packets, int new_bit_index, int old_bit_index) { + RTC_CHECK_LT(new_bit_index, 8 * new_mask_bytes); + // Copy column from the old mask to the beginning of the new mask and shift it // out from the old mask. for (uint16_t row = 0; row < num_fec_packets; ++row) { diff --git a/test/fuzzers/ulpfec_generator_fuzzer.cc b/test/fuzzers/ulpfec_generator_fuzzer.cc index 995bf290b3..ba9a53af58 100644 --- a/test/fuzzers/ulpfec_generator_fuzzer.cc +++ b/test/fuzzers/ulpfec_generator_fuzzer.cc @@ -31,7 +31,7 @@ void FuzzOneInput(const uint8_t* data, size_t size) { data[i++] % 128, static_cast(data[i++] % 10), kFecMaskBursty}; generator.SetFecParameters(params); uint16_t seq_num = data[i++]; - + uint16_t prev_seq_num = 0; while (i + 3 < size) { size_t rtp_header_length = data[i++] % 10 + 12; size_t payload_size = data[i++] % 10; @@ -40,13 +40,20 @@ void FuzzOneInput(const uint8_t* data, size_t size) { std::unique_ptr packet( new uint8_t[payload_size + rtp_header_length]); memcpy(packet.get(), &data[i], payload_size + rtp_header_length); + + // Make sure sequence numbers are increasing. ByteWriter::WriteBigEndian(&packet[2], seq_num++); i += payload_size + rtp_header_length; - // Make sure sequence numbers are increasing. const bool protect = data[i++] % 2 == 1; - if (protect) { + + // Check the sequence numbers are monotonic. In rare case the packets number + // may loop around and in the same FEC-protected group the packet sequence + // number became out of order. + if (protect && static_cast(seq_num - prev_seq_num) < + kUlpfecMaxMediaPackets) { generator.AddRtpPacketAndGenerateFec(packet.get(), payload_size, rtp_header_length); + prev_seq_num = seq_num; } const size_t num_fec_packets = generator.NumAvailableFecPackets(); if (num_fec_packets > 0) {