From b83cd92a1a593f0e4cc5b4ec06add3521d9122e8 Mon Sep 17 00:00:00 2001
From: Philipp Hancke <phancke@microsoft.com>
Date: Wed, 9 Nov 2022 11:06:38 +0100
Subject: [PATCH] generateKeyFrame: validate rids argument

BUG=chromium:1354101

Change-Id: Ie850d807e47c72470a50daffec5679c7a23111dc
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/282380
Reviewed-by: Florent Castelli <orphis@webrtc.org>
Commit-Queue: Philipp Hancke <phancke@microsoft.com>
Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#38591}
---
 pc/rtp_sender.cc                   | 16 ++++++++++++++--
 pc/rtp_sender_receiver_unittest.cc | 30 ++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/pc/rtp_sender.cc b/pc/rtp_sender.cc
index 43744ab73e..698d7ffe61 100644
--- a/pc/rtp_sender.cc
+++ b/pc/rtp_sender.cc
@@ -697,9 +697,21 @@ rtc::scoped_refptr<DtmfSenderInterface> VideoRtpSender::GetDtmfSender() const {
 RTCError VideoRtpSender::GenerateKeyFrame(
     const std::vector<std::string>& rids) {
   RTC_DCHECK_RUN_ON(signaling_thread_);
-  // TODO(crbug.com/1354101): check that rids are a subset of this senders rids
-  // (or empty).
   if (video_media_channel() && ssrc_ && !stopped_) {
+    auto parameters = GetParameters();
+    for (const auto& rid : rids) {
+      if (rid.empty()) {
+        LOG_AND_RETURN_ERROR(RTCErrorType::INVALID_PARAMETER,
+                             "Attempted to specify an empty rid.");
+      }
+      if (!absl::c_any_of(parameters.encodings,
+                          [&rid](const RtpEncodingParameters& parameters) {
+                            return parameters.rid == rid;
+                          })) {
+        LOG_AND_RETURN_ERROR(RTCErrorType::INVALID_PARAMETER,
+                             "Attempted to specify a rid not configured.");
+      }
+    }
     worker_thread_->PostTask([&, rids] {
       video_media_channel()->GenerateSendKeyFrame(ssrc_, rids);
     });
diff --git a/pc/rtp_sender_receiver_unittest.cc b/pc/rtp_sender_receiver_unittest.cc
index d66ee65f4c..5df57958c8 100644
--- a/pc/rtp_sender_receiver_unittest.cc
+++ b/pc/rtp_sender_receiver_unittest.cc
@@ -1468,6 +1468,36 @@ TEST_F(RtpSenderReceiverTest, VideoReceiverCanGetParametersWithSimulcast) {
   DestroyVideoRtpReceiver();
 }
 
+TEST_F(RtpSenderReceiverTest, GenerateKeyFrameWithAudio) {
+  CreateAudioRtpSender();
+
+  auto error = audio_rtp_sender_->GenerateKeyFrame({});
+  EXPECT_FALSE(error.ok());
+  EXPECT_EQ(error.type(), RTCErrorType::UNSUPPORTED_OPERATION);
+
+  DestroyAudioRtpSender();
+}
+
+TEST_F(RtpSenderReceiverTest, GenerateKeyFrameWithVideo) {
+  CreateVideoRtpSenderWithSimulcast({"1", "2", "3"});
+
+  auto error = video_rtp_sender_->GenerateKeyFrame({});
+  EXPECT_TRUE(error.ok());
+
+  error = video_rtp_sender_->GenerateKeyFrame({"1"});
+  EXPECT_TRUE(error.ok());
+
+  error = video_rtp_sender_->GenerateKeyFrame({""});
+  EXPECT_FALSE(error.ok());
+  EXPECT_EQ(error.type(), RTCErrorType::INVALID_PARAMETER);
+
+  error = video_rtp_sender_->GenerateKeyFrame({"no-such-rid"});
+  EXPECT_FALSE(error.ok());
+  EXPECT_EQ(error.type(), RTCErrorType::INVALID_PARAMETER);
+
+  DestroyVideoRtpSender();
+}
+
 // Test that makes sure that a video track content hint translates to the proper
 // value for sources that are not screencast.
 TEST_F(RtpSenderReceiverTest, PropagatesVideoTrackContentHint) {