From a715f28968956c4bb995fa2a75ed279944988f64 Mon Sep 17 00:00:00 2001 From: Danil Chapovalov Date: Wed, 11 Jul 2018 17:50:41 +0200 Subject: [PATCH] Fix handling invalid empty red packets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: chromium:856823 Change-Id: I3e64697cd99c6ca67e1102e18ec03965f67d4b9c Reviewed-on: https://webrtc-review.googlesource.com/88227 Reviewed-by: Åsa Persson Commit-Queue: Danil Chapovalov Cr-Commit-Position: refs/heads/master@{#23946} --- video/rtp_video_stream_receiver.cc | 3 ++- video/rtp_video_stream_receiver_unittest.cc | 23 +++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/video/rtp_video_stream_receiver.cc b/video/rtp_video_stream_receiver.cc index 7634797877..b459d61178 100644 --- a/video/rtp_video_stream_receiver.cc +++ b/video/rtp_video_stream_receiver.cc @@ -405,7 +405,8 @@ void RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader( size_t packet_length, const RTPHeader& header) { RTC_DCHECK_CALLED_SEQUENTIALLY(&worker_task_checker_); - if (header.payloadType == config_.rtp.red_payload_type) { + if (header.payloadType == config_.rtp.red_payload_type && + packet_length > header.headerLength + header.paddingLength) { if (packet[header.headerLength] == config_.rtp.ulpfec_payload_type) { rtp_receive_statistics_->FecPacketReceived(header, packet_length); // Notify video_receiver about received FEC packets to avoid NACKing these diff --git a/video/rtp_video_stream_receiver_unittest.cc b/video/rtp_video_stream_receiver_unittest.cc index 93aea58422..394fa5acdc 100644 --- a/video/rtp_video_stream_receiver_unittest.cc +++ b/video/rtp_video_stream_receiver_unittest.cc @@ -236,6 +236,29 @@ TEST_F(RtpVideoStreamReceiverTest, NoInfiniteRecursionOnEncapsulatedRedPacket) { rtp_video_stream_receiver_->OnRtpPacket(packet); } +TEST_F(RtpVideoStreamReceiverTest, + DropsPacketWithRedPayloadTypeAndEmptyPayload) { + const uint8_t kRedPayloadType = 125; + config_.rtp.red_payload_type = kRedPayloadType; + SetUp(); // re-create rtp_video_stream_receiver with red payload type. + // clang-format off + const uint8_t data[] = { + 0x80, // RTP version. + kRedPayloadType, // Payload type. + 0, 0, 0, 0, 0, 0, // Don't care. + 0, 0, 0x4, 0x57, // SSRC + // Empty rtp payload. + }; + // clang-format on + RtpPacketReceived packet; + // Manually convert to CopyOnWriteBuffer to be sure capacity == size + // and asan bot can catch read buffer overflow. + EXPECT_TRUE(packet.Parse(rtc::CopyOnWriteBuffer(data))); + rtp_video_stream_receiver_->StartReceive(); + rtp_video_stream_receiver_->OnRtpPacket(packet); + // Expect asan doesn't find anything. +} + TEST_F(RtpVideoStreamReceiverTest, GenericKeyFrameBitstreamError) { WebRtcRTPHeader rtp_header; const std::vector data({1, 2, 3, 4});