admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix null-pointer dereference in RTPSenderVideo.

Browse Source 
Since the address of the dereference is taken this inputs a garbage
almost-null pointer into RtpPacketizer. Not likely that a load/store is
performed on the address, but UBSan fires and it's a source of potential
future errors.

BUG=webrtc:5124, webrtc:5490
R=stefan@webrtc.org

Review URL: https://codereview.webrtc.org/1677003002 .

Cr-Commit-Position: refs/heads/master@{#11528}
This commit is contained in:
Peter Boström 2016-02-08 15:00:16 +01:00
parent 58c664c13d
commit c0ae305a9e
2 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
webrtc/modules/rtp_rtcp/source/rtp_sender_video.cc
View File

@ -230,14 +230,14 @@ int32_t RTPSenderVideo::SendVideo(const RtpVideoCodecTypes videoType,
const uint8_t* payloadData,
const size_t payloadSize,
const RTPFragmentationHeader* fragmentation,
const RTPVideoHeader* rtpHdr) {
const RTPVideoHeader* video_header) {
if (payloadSize == 0) {
return -1;
}
rtc::scoped_ptr<RtpPacketizer> packetizer(
RtpPacketizer::Create(videoType, _rtpSender.MaxDataPayloadLength(),
&(rtpHdr->codecHeader), frameType));
rtc::scoped_ptr<RtpPacketizer> packetizer(RtpPacketizer::Create(
videoType, _rtpSender.MaxDataPayloadLength(),
video_header ? &(video_header->codecHeader) : nullptr, frameType));
StorageType storage;
bool fec_enabled;
@ -253,7 +253,7 @@ int32_t RTPSenderVideo::SendVideo(const RtpVideoCodecTypes videoType,
// Register CVO rtp header extension at the first time when we receive a frame
// with pending rotation.
RTPSenderInterface::CVOMode cvo_mode = RTPSenderInterface::kCVONone;
if (rtpHdr && rtpHdr->rotation != kVideoRotation_0) {
if (video_header && video_header->rotation != kVideoRotation_0) {
cvo_mode = _rtpSender.ActivateCVORtpHeaderExtension();
}
@ -292,7 +292,7 @@ int32_t RTPSenderVideo::SendVideo(const RtpVideoCodecTypes videoType,
// (e.g. a P-Frame) only if the current value is different from the previous
// value sent.
// Here we are adding it to every packet of every frame at this point.
if (!rtpHdr) {
if (!video_header) {
RTC_DCHECK(!_rtpSender.IsRtpHeaderExtensionRegistered(
kRtpExtensionVideoRotation));
} else if (cvo_mode == RTPSenderInterface::kCVOActivated) {
@ -306,7 +306,7 @@ int32_t RTPSenderVideo::SendVideo(const RtpVideoCodecTypes videoType,
RTPHeader rtp_header;
rtp_parser.Parse(&rtp_header);
_rtpSender.UpdateVideoRotation(dataBuffer, packetSize, rtp_header,
rtpHdr->rotation);
video_header->rotation);
}
if (fec_enabled) {
SendVideoPacketAsRed(dataBuffer, payload_bytes_in_packet,

2
webrtc/modules/rtp_rtcp/source/rtp_sender_video.h
View File

@ -52,7 +52,7 @@ class RTPSenderVideo {
const uint8_t* payloadData,
const size_t payloadSize,
const RTPFragmentationHeader* fragmentation,
const RTPVideoHeader* rtpHdr);
const RTPVideoHeader* video_header);
int32_t SendRTPIntraRequest();