admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing heap read overflow when "sctp-port" is in a video description.

Browse Source 
This added an SCTP codec, which is later re-interpreted as a video
codec. We shouldn't be adding codecs that don't match the type of the
media description.

BUG=chromium:648062

Review-Url: https://codereview.webrtc.org/2354723002
Cr-Commit-Position: refs/heads/master@{#14421}
This commit is contained in:
deadbeef 2016-09-28 10:04:34 -07:00 committed by Commit bot
parent 478681e1e6
commit 7e146cb97e
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
webrtc/api/webrtcsdp.cc
View File

@ -2651,6 +2651,11 @@ bool ParseContent(const std::string& message,
return false;
}
} else if (IsDtlsSctp(protocol) && HasAttribute(line, kAttributeSctpPort)) {
if (media_type != cricket::MEDIA_TYPE_DATA) {
return ParseFailed(
line, "sctp-port attribute found in non-data media description.",
error);
}
int sctp_port;
if (!ParseSctpPort(line, &sctp_port, error)) {
return false;

20
webrtc/api/webrtcsdp_unittest.cc
View File

@ -3183,3 +3183,23 @@ TEST_F(WebRtcSdpTest, SerializeUnifiedPlanSessionDescription) {
MakeUnifiedPlanDescription();
TestSerialize(jdesc_, true);
}
// Regression test for heap overflow bug:
// https://bugs.chromium.org/p/chromium/issues/detail?id=647916
TEST_F(WebRtcSdpTest, DeserializeSctpPortInVideoDescription) {
JsepSessionDescription jdesc_output(kDummyString);
// The issue occurs when the sctp-port attribute is found in a video
// description. The actual heap overflow occurs when parsing the fmtp line.
const char kSdpWithSctpPortInVideoDescription[] =
"v=0\r\n"
"o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
"s=-\r\n"
"t=0 0\r\n"
"m=video 9 UDP/DTLS/SCTP 120\r\n"
"a=sctp-port 5000\r\n"
"a=fmtp:108 foo=10\r\n";
ExpectParseFailure(std::string(kSdpWithSctpPortInVideoDescription),
"sctp-port");
}