From a4549d6588207a22ec0c5decc2dfc9fc9a1cde70 Mon Sep 17 00:00:00 2001 From: deadbeef Date: Fri, 10 Feb 2017 17:26:22 -0800 Subject: [PATCH] Fix SDP parsing crash due to missing track ID in "a=msid". BUG=chromium:686405 Review-Url: https://codereview.webrtc.org/2676293003 Cr-Commit-Position: refs/heads/master@{#16545} --- webrtc/pc/webrtcsdp.cc | 7 +++++++ webrtc/pc/webrtcsdp_unittest.cc | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/webrtc/pc/webrtcsdp.cc b/webrtc/pc/webrtcsdp.cc index 93b77274bf..ed49c344e8 100644 --- a/webrtc/pc/webrtcsdp.cc +++ b/webrtc/pc/webrtcsdp.cc @@ -2136,10 +2136,17 @@ static bool ParseMsidAttribute(const std::string& line, return ParseFailedExpectFieldNum(line, expected_fields, error); } + if (track_id->empty()) { + return ParseFailed(line, "Missing track ID in msid attribute.", error); + } + // msid: if (!GetValue(field1, kAttributeMsid, stream_id, error)) { return false; } + if (stream_id->empty()) { + return ParseFailed(line, "Missing stream ID in msid attribute.", error); + } return true; } diff --git a/webrtc/pc/webrtcsdp_unittest.cc b/webrtc/pc/webrtcsdp_unittest.cc index 75116e8e33..1a6a212cdd 100644 --- a/webrtc/pc/webrtcsdp_unittest.cc +++ b/webrtc/pc/webrtcsdp_unittest.cc @@ -3446,3 +3446,36 @@ TEST_F(WebRtcSdpTest, DeserializeInvalidPortInCandidateAttribute) { JsepSessionDescription jdesc_output(kDummyString); EXPECT_FALSE(SdpDeserialize(kSdpWithInvalidCandidatePort, &jdesc_output)); } + +// Test that "a=msid" with a missing track ID is rejected and doesn't crash. +// Regression test for: +// https://bugs.chromium.org/p/chromium/issues/detail?id=686405 +TEST_F(WebRtcSdpTest, DeserializeMsidAttributeWithMissingTrackId) { + static const char kSdpWithMissingTrackId[] = + "v=0\r\n" + "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n" + "s=-\r\n" + "t=0 0\r\n" + "m=audio 9 RTP/SAVPF 111\r\n" + "c=IN IP4 0.0.0.0\r\n" + "a=rtpmap:111 opus/48000/2\r\n" + "a=msid:stream_id \r\n"; + + JsepSessionDescription jdesc_output(kDummyString); + EXPECT_FALSE(SdpDeserialize(kSdpWithMissingTrackId, &jdesc_output)); +} + +TEST_F(WebRtcSdpTest, DeserializeMsidAttributeWithMissingStreamId) { + static const char kSdpWithMissingStreamId[] = + "v=0\r\n" + "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n" + "s=-\r\n" + "t=0 0\r\n" + "m=audio 9 RTP/SAVPF 111\r\n" + "c=IN IP4 0.0.0.0\r\n" + "a=rtpmap:111 opus/48000/2\r\n" + "a=msid: track_id\r\n"; + + JsepSessionDescription jdesc_output(kDummyString); + EXPECT_FALSE(SdpDeserialize(kSdpWithMissingStreamId, &jdesc_output)); +}