admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash invalid entry access in StreamConfigs.

Browse Source 
When incoming codec_settings_list size is more than
the internal RTP source indentifiers, then it would
cause an invalid memory acccess.

The fix is to operate the stream config update only
when these sizes are match.

Bug: chromium:378724147
Change-Id: I2195df82e0e05619cd2a9bc2d4cb5e8f3efa1446
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/368120
Reviewed-by: Harald Alvestrand <hta@webrtc.org>
Reviewed-by: Henrik Boström <hbos@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#43603}
This commit is contained in:
Sunggook Chue 2024-12-16 15:32:03 -08:00 committed by WebRTC LUCI CQ
parent b15683c12d
commit 84b33a4439
2 changed files with 59 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
media/engine/webrtc_video_engine.cc
View File

@ -1990,10 +1990,9 @@ void WebRtcVideoSendChannel::WebRtcVideoSendStream::SetCodec(
parameters_.codec_settings = codec_settings;
// Settings for mixed-codec simulcast
// Settings for mixed-codec simulcast.
if (!codec_settings_list.empty()) {
RTC_DCHECK_EQ(parameters_.config.rtp.ssrcs.size(),
codec_settings_list.size());
if (parameters_.config.rtp.ssrcs.size() == codec_settings_list.size()) {
parameters_.config.rtp.stream_configs.resize(
parameters_.config.rtp.ssrcs.size());
for (size_t i = 0; i < codec_settings_list.size(); i++) {
@ -2014,7 +2013,19 @@ void WebRtcVideoSendChannel::WebRtcVideoSendStream::SetCodec(
rtx.payload_type = cs.rtx_payload_type;
}
}
} else {
// TODO(crbug.com/378724147): We need to investigate when it
// has mismatched sizes.
RTC_DCHECK_EQ(parameters_.config.rtp.ssrcs.size(),
codec_settings_list.size());
RTC_LOG(LS_ERROR) << "Mismatched sizes between codec_settings_list:"
<< codec_settings_list.size()
<< ", parameters_.config.rtp.ssrcs:"
<< parameters_.config.rtp.ssrcs.size();
}
}
parameters_.codec_settings_list = codec_settings_list;
// TODO(bugs.webrtc.org/8830): Avoid recreation, it should be enough to call

27
media/engine/webrtc_video_engine_unittest.cc
View File

@ -9225,6 +9225,33 @@ TEST_F(WebRtcVideoChannelTest, SetMixedCodecSimulcastStreamConfig) {
EXPECT_EQ(config.rtp.stream_configs[2].payload_type, vp9.id);
}
#if RTC_DCHECK_IS_ON && GTEST_HAS_DEATH_TEST && !defined(WEBRTC_ANDROID)
TEST_F(WebRtcVideoChannelTest,
SetMixedCodecSimulcastWithDifferentConfigSettingsSizes) {
webrtc::test::ScopedKeyValueConfig field_trials(
field_trials_, "WebRTC-MixedCodecSimulcast/Enabled/");
AddSendStream();
cricket::VideoSenderParameters parameters;
cricket::Codec vp8 = GetEngineCodec("VP8");
parameters.codecs.push_back(vp8);
// `codec_settings_list.size()` is 1 after this in the
EXPECT_TRUE(send_channel_->SetSenderParameters(parameters));
// It sets 2 sizes of config ssrc.
StreamParams sp = CreateSimStreamParams("cname", {123, 456});
std::vector<cricket::RidDescription> rid_descriptions2;
rid_descriptions2.emplace_back("f", cricket::RidDirection::kSend);
rid_descriptions2.emplace_back("h", cricket::RidDirection::kSend);
sp.set_rids(rid_descriptions2);
// `WebRtcVideoSendStream::SetCodec` test for different sizes
// between parameters_.config.rtp.ssrcs.size() and codec_settings_list.size().
EXPECT_DEATH(send_channel_->AddSendStream(sp), "");
}
#endif
// Test that min and max bitrate values set via RtpParameters are correctly
// propagated to the underlying encoder for a single stream.
TEST_F(WebRtcVideoChannelTest, MinAndMaxBitratePropagatedToEncoder) {