admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix handling invalid empty red packets

Browse Source 
Bug: chromium:856823
Change-Id: I3e64697cd99c6ca67e1102e18ec03965f67d4b9c
Reviewed-on: https://webrtc-review.googlesource.com/88227
Reviewed-by: Åsa Persson <asapersson@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23946}
This commit is contained in:
Danil Chapovalov 2018-07-11 17:50:41 +02:00 committed by Commit Bot
parent 84fd2471ed
commit a715f28968
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
video/rtp_video_stream_receiver.cc
View File

@ -405,7 +405,8 @@ void RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(
size_t packet_length,
const RTPHeader& header) {
RTC_DCHECK_CALLED_SEQUENTIALLY(&worker_task_checker_);
if (header.payloadType == config_.rtp.red_payload_type) {
if (header.payloadType == config_.rtp.red_payload_type &&
packet_length > header.headerLength + header.paddingLength) {
if (packet[header.headerLength] == config_.rtp.ulpfec_payload_type) {
rtp_receive_statistics_->FecPacketReceived(header, packet_length);
// Notify video_receiver about received FEC packets to avoid NACKing these

23
video/rtp_video_stream_receiver_unittest.cc
View File

@ -236,6 +236,29 @@ TEST_F(RtpVideoStreamReceiverTest, NoInfiniteRecursionOnEncapsulatedRedPacket) {
rtp_video_stream_receiver_->OnRtpPacket(packet);
}
TEST_F(RtpVideoStreamReceiverTest,
DropsPacketWithRedPayloadTypeAndEmptyPayload) {
const uint8_t kRedPayloadType = 125;
config_.rtp.red_payload_type = kRedPayloadType;
SetUp(); // re-create rtp_video_stream_receiver with red payload type.
// clang-format off
const uint8_t data[] = {
0x80, // RTP version.
kRedPayloadType, // Payload type.
0, 0, 0, 0, 0, 0, // Don't care.
0, 0, 0x4, 0x57, // SSRC
// Empty rtp payload.
};
// clang-format on
RtpPacketReceived packet;
// Manually convert to CopyOnWriteBuffer to be sure capacity == size
// and asan bot can catch read buffer overflow.
EXPECT_TRUE(packet.Parse(rtc::CopyOnWriteBuffer(data)));
rtp_video_stream_receiver_->StartReceive();
rtp_video_stream_receiver_->OnRtpPacket(packet);
// Expect asan doesn't find anything.
}
TEST_F(RtpVideoStreamReceiverTest, GenericKeyFrameBitstreamError) {
WebRtcRTPHeader rtp_header;
const std::vector<uint8_t> data({1, 2, 3, 4});