From c2dd59c25da7532df4b4e75d853510a4a11724bf Mon Sep 17 00:00:00 2001 From: Danil Chapovalov Date: Tue, 6 Feb 2018 11:29:35 +0100 Subject: [PATCH] Skip oversized rtp header extension when parsing Rtp Packet. Rtp Packets in webrtc expected to be less that 1500, i.e. way less that 2^16 bytes for extensions block. This CL explicitly discards longer extension. Bug: chromium:809046 Change-Id: Ibed33b51bafc3fd4804ec135f66110c6d2796734 Reviewed-on: https://webrtc-review.googlesource.com/48061 Commit-Queue: Danil Chapovalov Reviewed-by: Alex Loiko Cr-Commit-Position: refs/heads/master@{#21910} --- modules/rtp_rtcp/source/rtp_packet.cc | 14 +++++++++----- test/fuzzers/corpora/rtp-corpus/rtp-5 | Bin 0 -> 261774 bytes 2 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 test/fuzzers/corpora/rtp-corpus/rtp-5 diff --git a/modules/rtp_rtcp/source/rtp_packet.cc b/modules/rtp_rtcp/source/rtp_packet.cc index f2a9709ca4..dec797d686 100644 --- a/modules/rtp_rtcp/source/rtp_packet.cc +++ b/modules/rtp_rtcp/source/rtp_packet.cc @@ -499,11 +499,15 @@ bool RtpPacket::ParseBuffer(const uint8_t* buffer, size_t size) { << "Duplicate rtp header extension id " << id << ". Overwriting."; } - extensions_size_ += kOneByteHeaderSize; - extension_entries_[idx].offset = - rtc::dchecked_cast(extension_offset + extensions_size_); - extension_entries_[idx].length = rtc::dchecked_cast(length); - extensions_size_ += length; + size_t offset = + extension_offset + extensions_size_ + kOneByteHeaderSize; + if (!rtc::IsValueInRangeForNumericType(offset)) { + RTC_DLOG(LS_WARNING) << "Oversized rtp header extension."; + break; + } + extension_entries_[idx].offset = static_cast(offset); + extension_entries_[idx].length = length; + extensions_size_ += kOneByteHeaderSize + length; } } payload_offset_ = extension_offset + extensions_capacity; diff --git a/test/fuzzers/corpora/rtp-corpus/rtp-5 b/test/fuzzers/corpora/rtp-corpus/rtp-5 new file mode 100644 index 0000000000000000000000000000000000000000..7dd663200723a7a0f5ae26c976515321edc32a97 GIT binary patch literal 261774 zcmeI5U1%Ifw#R#7D>&iCJ5GY*`!-`j#v_dGNVa6f!)``eSii~g(-Kg8^)c2}2-#6S zE;nyi$%aLV1#aJUz)!Zo7h?9sZ4*dBz>&RAhCBrJCB*pSF%W|H;(#7Z(zmL6KB{|8 zb=PUv#N+s1K{Hk7oa(9movMFzkF2y`b(g2=6O*Ol%u;#q@=gD&EOWE7uXsvvMg5Xj z4=k17Rr@mk^J8xH`U&ry%Qv03*Gu9p=Qz&5zmC&vRYnes)L$H5oD(q@ z!nix12JZvn^~()eJ?(8hemCa~Ro(xdDosw*D|u1M^2Mu(;(4_R@#fSDg~DLLZx+#r zmSW-9$oPQ+^CP1NM(4&V`zw|2<>$_g4(}VQ-;pC-oEuvlUi^=R1C{alWBd2LI6Shy z`MLk4e(uHagPq`$tqx`W*&XtYwmtl?^nXYZ}WMmP{Mip+gwa^isrB@S_9$1;X|1y97 zhlm_uThNkorw>bHq}dv_d4-g+jV02{_P~(H2;S5Nc%>qW1b|lrM`{B?k!3?k#hM-f zVNGYGMu3+}BfV~$7lZ;rk%a)SPx`!0jj%oOaYd1eJQ4t*;7xh(0A zuwvr#QV3q)m4yJWPd06c^ny_EkoP7!l9Fr<+lj=bG%pX}#p4w&Bwimf8WW$yqBVk- z77ghDFA|H^Xqy*=BFi<0Ha+GJ+lj;uY0h3of)|e$gaSg5g#fP)Z%&fY5LOb4)@Yj- zgn~Ea!3(^y5a9LEE`M_ego1~>H__(#(ni`&Brc`3s7VKSkyy0Ga3N{k<_=7Jb5=4E zyueGli}BEq(YEIoghHFG1P7TKp3!z9u|x9sgBOn%gd#x?v@RZFG8#fbV$mAGON)kd z*yaVH(5gX#gG>$2XgiVEA$k14i^mH>k)Q`!7mqO+4WS^hXpP{dMMFAl^MX)l)gZw^ zriN#R@Vq*8%lPz5goNJ>bb@+u_=WOkQw-dU@*d4(sFbu>yp+XL&? zu8(BrA0$J!i7Y-ct%Wo@Y1R>4-FZO`9)&U8g27}P-tg&f3DHAi+VVhG(>$NbHb2{@}&q1))gL z1Feh4n2d%{kXW=v@Y13o9kzKvD70#j;2=}OGulohc1Rw7@Z#};P$cMq*2QB?Mnfn_ zELtOYY0;1l+q@tYS~W;;kg4GrZ6^{tB#%FM@pwTf67)dp;xQ(pyM@AEc9*B>6O*Ol z%u;#q@=a$Ysa)()S=p2HsSmA>PUZcd&cEEpA>O@@zAK#*BBvM6*gY9}{o~P4;W&}x zHh3lTiF?DzAGc;`W8(9mffsmncAi*`hlY%{J-;9nu^bsS$<*+SwiAgRlE)vsc)TDK zM#>Ni;xQ(pArvGQtr5JmXh?@`UJ#0y1{gKT)bNb96Nw#?#~-|SydV@t$`A|UF(#uS z6eJd{5xlf$NQZ4+eI^v8_DMtW+bE1G;AMoV9Ryx&6h@Uk6N=85k;o1UlNxxLQ0l~h zSBHg34MGvSt1xPskWGoPeQAh^p8`DQ2Co>9lqQ72NEu>5DNs$^5DF7Yofz=yurR4v zD*+DS0xtqe zf+?#|yw-J0C`A{NL<4vw;^}gNR~M2*gKb_}m7;5qwg(2u??Rkt0Ix(mT~6@oLXv2J zP=o|{uZc*_oDfzsPOT{LYLPH|x6KPe!IKE^09EZULII)3LV(wYoXR|-?TL>oRvv!{1#ilO7kFhM!0W?X!(_B=Va3Gfr4YQpD+>W$ zA9CsQj1USQ^4>)Aaz;kmP9!d+Nz7U!cxlm)j&LE7E}jt+AH1}x%tJ#)V}6lXv_{*! zAQal!o#4=>$J}8%k=P;4*~>`q;_-q|BHArxf zso@!IClWg(k3V?vctI!<^g!$4F(#uS6eJd{5xlf$NQZ4+5DKjtBsj>_@Qk(-i5-&1 zAG~9fc)Kpg%Rm#q-k9&UE^RYcrdv}V`nz;#`3{24D z){4%ud~s2sn^)N`Dxk-`kWT2anMVGSQMz>lJ%%1fGyvDf5gfmU2K4xsR9dsoO48%j z_f#!qGJa3Jqzpb4-&Z_Li@GoM*Z?3z$4m%*$*3gJ>G&!^6|8YAQ2Wp{b1K5@15j1&H)bFtvB{CQ<%<*8lg&iTIM-|?I6f_Zs93_V2msJ>q) zd`G)f>zQ2G+N~O=>djWMkaL{Qzhd*eBZo)Fj#Wp-$B!MD9~s>>Ha9jpx^Jw0M}#?x zb7PCci;D{fD&zAD`}e&#JhETyD(a3?a~cP$&h{I!e7onywTgSfsWu)j`OXVF4~oA4 z-x29?TeL34e%8H@f|#A#E;~1C)6=K&=Vzyj;a?QX*Du7+!b{#M_tl`|CGYdO<=pyP z^P+WY({1DiZf!Q)+`U5^<&WQ9FJ0Lve<|MH5g#pow$*APP84ze!!07B;f)+E)Yd|0 zEhwH0l%F^3z3PcXz9)V%6!}?XNjz3~B4X^~6n>K9ej;{^N~|3;i_K$tp1AEpC|;*) zCo>+D>J}_v%8_QvJi>ged=Y71$UBjCK0g?1CpC8j&fg@2e65tUQ;hp7CAV>XU}K~F z^6@`@Ba<>98qMaMh$E4M@z_J>u#(zm617{6Oa8QRlwBx&O z_ssVFV27PtS{j@wmqm_pZ%i(g^ZD+`eE!+ioQ_WJw8iu6({#UOk{9D%ZI3@lQ{DYJDdZz6*x{R4Dj`LMX|aW3^7kK&6S0?fK5V z^3mX4dF#O1T29jkb9~D0ovIyud390bU>N@;7%tD0s+w z6K$R^ZKUl);!;|Rnsk5{iA8G+7n0U(?!d%1XC))S3%s*6scqahR|7OfGyv}j0&ZC(%xtr{da$kgzRwiAgRlE=SC zyfzYM4a3Dd7c$!R1Pez`eiYAWdtg1vBqLi1p*%EXbT4_ye@fa{g(Sc;_L5g$v66$~ zp&_Gf^9mV}AH_4;9vFmz#~-}FOC?}?Jwhl#0=!o>BN^+q6A7W*qahR|7OfGyv}j0& zZC>{w6tTsFCJ2B42!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*=9KwlAf(kb-S zcrX|c=uZN{?`8Y$@76))Dcn|;q5C8!X009sH z0doTQ1-m&bM1sKm5g_jyc}ClJnc)fX#z02f9vHqZATeu=;H5=FI>3v>qBTM&vS_~+ zr@7-77S_k+-u(B)|NPU!TmNTPzAx+J-hA~>Z-)o-4B?q$(MJBlybMpQM`2nD<__Du z!ZS7hd~KxdfkE-Ls7Z%iUY7q62{~e(5%cT8@`6xg*%Wv=Bcn0#Ni13;cxlm)4%@sS z6cCCm1bBVOsmwFlp7?gJz<4-Pqj_k^XxqHPF_Ry~Guj>)63OEaUf`t?u)Q836sht~ z1gIIwSht->2n8<@;Kkzwp&)c1)x={=Mnfn_ELtOYY0;1l+q@tYsj5H(kf|{;4qkSb zr|J_|OV2n<<-yB0onpaX`SZ%k%2T_}o%4OizvDOC1@rQJ7Oj|)-$=V zwOch#)tjwiLHr`bQ_7LUqhrUaBje-84$O~??i!mL8y(#@R=*>EU$Qtiwm7`FxNx8{ zKEJSk-;2W|`<0%u>Nqv0aj@!azah)Fdv08-xF?)y zB=SA+lcC7ZB1_`2!V?i=7pL%(9QPBkV^m`8pjm7l)ARgQw^W>3o~+MIgwrwS6dlKC zCi8=ch2#uXPcCn-PwW;xUzBhVTPk;_ot3ZLTz*TT>to~u%UEu0dT-|L{UJ=aq_rhX zp?ICHoy>Sps#~yxDMy+u^9b{?@8^nSMLPSRZfe&cbx%lq&_sTi^7& ze@2g$ZJ9=ovAX(~RZ)f<@zNTEG_0=rzI?qZ*U#~2ACp$s0?TTsp5>HT!x9|RA&>0% zuG>AceLvV?CzqB6XUb)fqud*lOXYmNJ2Ibtwl$}tlRItkJo_}=uVq!=_o$6_{W(!< zAEa%Kj-qW=DxIVKeZv!W<)o<2!MsxiFT!!R+Cuge%uJuzAD-rx;(@1L)`Cmx%xI`fA_C}xASr#sLIzc?o+Sf{kH0S)``&6#3?M# z6emhkll7&t(PiIhaiqT~M>{`s_H1cW?C(xxPkE(z2c2`BbtmyI=@D{1{PUxR`O#nV zH8&u?Uy!#PLMm$BUS&OYS3_}#+B?c{QgKv7{rhJ76U82{jzkQn+O73=t-I3Hh?Avj zGtI9x+`H>5jqbp}B4tc|d7~+TF8a6S?NzfBw)&;kcS7O2a0oz!f?p_vlB_va>tqa6 znh4pR@7yaN4eph<4y>)^#ND&ACW_;nK0Vj1?7{ducc9Hg?rna*r5R|7*;V`%rEXf) zr6Qq!_f|()hA5+58<7~U$@aJS`1L3+1L1_=^&z8?ND_)~nHrwab|SGu^7w-nj~9d@K@YSp9%C{ZLP28D8o^78hIH8G1)CKV zLcx;=@B*(a1bBUTYnY6-y%AyJ^HK<2;FW~{uMfHOc}55Y4|#8*c{wAaZ6^|!(j;cB z5xlf$NJqGkNEgqDi4R^{Rpy}~qcOioELx*&UiTps+Gzm?2!H?xfB*=900@8p2!H?x zfB*=900@8p2!H?xfB*=900@AXueu{ruhKJ zVj*~5`pQ$g&Ykmp$G_t@+tFvNCAOXqy@%+a>idPlceG2jp2>x+-Kue_-fR^M;{SJ{ zKA`N#;nA^U)sgY>V+ZC(Mt6`=u|67d3xv|CJ#l?jKmGSw7{rg@V9@(#U z6?Mm{IgNu=XZsCVzTI=J=Vtp+ zp0)Q}o2c3*XE307G#Qx+EU1^JKfX*ME}Z zej;{|N~|3;i_K$tp1mH#sawJ4~SHdH;iyuCiLTlnPj1;asX zsob4*R=#p``7MR61IY=NvE179-pr{_1m6;-P`pmpPG&qP)h$@Ulq1cSd4%d?i)B6b zXW{c z>c&q2Z><2|4|dqerKQ1{a#=`X?hWxg>Bw`xTcLT)!@JWK&$Carj*#{Q@qE|A$itq` ziMRGaS_jK>j@Hx1u%{+5DPyV+*=r|PR65U-e+aU7W_A|YdjQ$Xw0wS42b%vunQ5Wp zLgWHKX{AX{XUb9s3T+w{4V^J9{V*~R88R5g8NKcZqLRk^wNm0cU01sww{zcdmk-w` z#Fq8S>#Kuu`I$i0?)| zmbcwPjcVRr>Klc&?LxcOseIP1o^01VuOjN-H`|{m_IPz9VmQ@qt+#94mC~lT2XHDU zOV?(aUu(E`*H;?dfq|v<<&DPufp^5a=--yNSItt`>X%yI35D;%ApjK$exVTVGMZzx zPA1zu*7khKZCoGN*eJhz{OC9G>z=IxYil`San?j}oYSZ0PCPbWb?!Ba2XD%6(eh#( z!T3906g3mMxB2~+W}qo%SMgVrx@lFHiiG}MyEkbVBCS@9*>V@@h2N@0aHKYD^9tuf z>c^%B*d7>ueU;8!jQ}r|MtU8*(iy1{5Q;2Yr%Etm9m2{32VM`B7lZ;rk%a)S4{wf> z(GUs}i`HnH7leX0<-rTQvJl|)(Jp^;2ZVx$yf@M2`O-$(P9*NRwWvu4c#&AN#&98N z-R2HVd~;SZ61>1myNmJAkkPj17lcBatpo>|8lKU1BC$jA_=6XZ7la}~540{GV=@{- zL1NJw!ApyVblBzvq0p*9f`d#A&uBZ5*dclRd&FxaVb(BQymKL=ZBMXp^yEkJjJ5~X zqf9cgl@Q89Lq_+Km;9%seN{*TJYz3;^%W~Q7#3SJ_>i^mH>!IKE^0d(AjR3HEXAOHd&00JNY0w7?Y0IvS+GsO{qjRdrR#iBa! zr+q4o^g4K@Gg2eKOQn%s4}~Z_E;YjTpQ<5|smLP%;1$7<+5oRqM3DdpMV4!}2trn4 z@Upu+RiC(8dd68Q4_?0M6bt^!pI25^p4xTpobNmS9lzNwn3w0n&_i^O>idPlceG2j zp2>x+-Kue_-fR^M;(yocDdouF(XnIIk@4|k2j)jcca6=BjgIactKX6TSKr0CvBlxV z#f1Zv@%e@Q`(7L#*{}4JRmZ70je}KZ`wdyX-E-qw#XaFv8;_TK=Y^dI1(zL>9=Ap7 zQtW5l`zVOnx$UxZvo<|_Dt~@#J&{+$LCj;f@ z4STP8B9ZTjpA1EQ7FiOH6`qI~yEuiP`N^QYNZWTPcCn-PwW;xUzBhVTPk;_ot3ZLTz*TT>p*gXWh}Qgy*G3B{tzZy z(%KTHP`pmpPG&qP)h$@Ulq1cSd4%~``6AN3kar^Oe10(2PHOH5oWDs3`C2Jyrx^EF zN^ax&z{W=T<>P<+MkZxIG@9l2!Fze*M7&ck+NaYG>i^E|OuwCCtdF;KXJNW>%9R4+ zt#5kXKcmOWwoIePSY7?gswhK_cxeqn8dg_*U%p*sj1k4dX*fn_yR&vMGFVF`}u zkVkfW*X^F!z8~zclS@m3Gv%_#QSOb&rE)&s9huKR+nUqS$(^=%o_(6`*Rrbbd(=j| z{+y__57M?qN6|JbmCn)rzTpYGa#B?1VBV>M7vZ>DZ6SLK=61EiyKNGcMrLQmJ8s*A=6_)#5b{)c>Ltf52E31LuLlxnEQN(Lep_`u>qKa3 z;uMx=iW8-&$@)^+=(6v$IMUygqn#f*d$zPG_IIbUr@YdX4{(ZCkiDHjeMz zbutDjO@wUEckY#s2KUNa2iDed;_lg56UA{(pPuVh_F(*-JJ4n#_cp)Z(hM}k>?;0> zQa7#YQjyTVd#j@?LzL03jYtgFgx{+1h}q^9P6*x@$Y|RG!>_MM%vvLOY0;1l@FKBj zjSz|~d#4tsxdXy#&Pqmt*MsE+p@2|iA;9ayo8x3Ogo4DPHQMF{q2Nt<@B*(a1bBV4 z%ir7qq2M9!O|*Hww2`(GiFYSIB-Bo?hPTu55CxdRj5oRy3OFYwatVmvftwC(u? zq0nY4!9k{mXSAJ2?2tVE;Kkzwp-9jJt&7K)jD}E9)IuxFO`7p^$4K|3GiOkjAX3aP9%hamk99U z@q$qBBm%s^D+>W$AKn@!qit_QnE1RDf){vYA;9ZHE`6R6Lcv4cn`mCn$Y|S%#HBQe zS!)C@EgI4hE+o>$Gh*U{msXW|Xvk>HFA|H^Xq(r42!(c9zySgv00JNY0w4eaAOHd& z00JNY0w4eaAOHd&00JNY0w4eaAkYT{o^%R*FbWI-1V8`;KmY_l00jDz0Irq#GcOnw z2!H?xfB*=900@8p2!H?xfB*=900@8p2!H?xfB*>e3jzEtp