From c3d937b3e4435b96560613ec0a5ea9760e896883 Mon Sep 17 00:00:00 2001
From: Danil Chapovalov <danilchap@webrtc.org>
Date: Tue, 27 Feb 2024 17:51:42 +0100
Subject: [PATCH] In RtpFrameReferenceFinder discard frames with too large
 spatial id

Bug: chromium:41495253
Change-Id: I681f64edfcba319ab9479a2ad10987452cf9b6d4
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/341265
Reviewed-by: Philip Eliasson <philipel@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#41829}
---
 modules/video_coding/BUILD.gn                  | 1 +
 modules/video_coding/rtp_generic_ref_finder.cc | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/modules/video_coding/BUILD.gn b/modules/video_coding/BUILD.gn
index e1aa75744b..eec1e66af4 100644
--- a/modules/video_coding/BUILD.gn
+++ b/modules/video_coding/BUILD.gn
@@ -233,6 +233,7 @@ rtc_library("video_coding") {
     "../../api/video:video_bitrate_allocation",
     "../../api/video:video_bitrate_allocator",
     "../../api/video:video_bitrate_allocator_factory",
+    "../../api/video:video_codec_constants",
     "../../api/video:video_frame",
     "../../api/video:video_frame_type",
     "../../api/video:video_rtp_headers",
diff --git a/modules/video_coding/rtp_generic_ref_finder.cc b/modules/video_coding/rtp_generic_ref_finder.cc
index fd5b8afda1..503a792bd5 100644
--- a/modules/video_coding/rtp_generic_ref_finder.cc
+++ b/modules/video_coding/rtp_generic_ref_finder.cc
@@ -12,6 +12,7 @@
 
 #include <utility>
 
+#include "api/video/video_codec_constants.h"
 #include "rtc_base/logging.h"
 
 namespace webrtc {
@@ -19,6 +20,13 @@ namespace webrtc {
 RtpFrameReferenceFinder::ReturnVector RtpGenericFrameRefFinder::ManageFrame(
     std::unique_ptr<RtpFrameObject> frame,
     const RTPVideoHeader::GenericDescriptorInfo& descriptor) {
+  RtpFrameReferenceFinder::ReturnVector res;
+  if (descriptor.spatial_index >= kMaxSpatialLayers) {
+    RTC_LOG(LS_WARNING) << "Spatial index " << descriptor.spatial_index
+                        << " is unsupported.";
+    return res;
+  }
+
   // Frame IDs are unwrapped in the RtpVideoStreamReceiver, no need to unwrap
   // them here.
   frame->SetId(descriptor.frame_id);
@@ -26,7 +34,6 @@ RtpFrameReferenceFinder::ReturnVector RtpGenericFrameRefFinder::ManageFrame(
   if (descriptor.temporal_index != kNoTemporalIdx)
     frame->SetTemporalIndex(descriptor.temporal_index);
 
-  RtpFrameReferenceFinder::ReturnVector res;
   if (EncodedFrame::kMaxFrameReferences < descriptor.dependencies.size()) {
     RTC_LOG(LS_WARNING) << "Too many dependencies in generic descriptor.";
     return res;