commit 1399211a96df6896ae6d3ac285853ba34ab4e424
author Danil Chapovalov <danilchap@webrtc.org> Tue Dec 29 16:40:05 2020
committer Commit Bot <commit-bot@chromium.org> Wed Dec 30 23:36:07 2020
tree daebc81747bccc80d77ad54bcc4e4ad86330e9d5
parent 5d2bf19be865c19ae09b21b32771ccda3c95eda0

Fix potential 32bit integer overflow on rtcp receiver report

Bug: b/174613134
Change-Id: I8c9c8496ca6e4072d280d2024edff61edf9be250
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/199960
Reviewed-by: Christoffer Rodbro <crodbro@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#32892}

modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.cc

diff --git a/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.cc b/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.cc
index e179ff5..8de2a91 100644
--- a/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.cc
+++ b/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.cc
@@ -357,8 +357,8 @@
   }
 }
 
-void SendSideBandwidthEstimation::UpdatePacketsLost(int packets_lost,
-                                                    int number_of_packets,
+void SendSideBandwidthEstimation::UpdatePacketsLost(int64_t packets_lost,
+                                                    int64_t number_of_packets,
                                                     Timestamp at_time) {
   last_loss_feedback_ = at_time;
   if (first_report_time_.IsInfinite())
@@ -366,21 +366,23 @@
 
   // Check sequence number diff and weight loss report
   if (number_of_packets > 0) {
-    // Accumulate reports.
-    lost_packets_since_last_loss_update_ += packets_lost;
-    expected_packets_since_last_loss_update_ += number_of_packets;
+    int64_t expected =
+        expected_packets_since_last_loss_update_ + number_of_packets;
 
     // Don't generate a loss rate until it can be based on enough packets.
-    if (expected_packets_since_last_loss_update_ < kLimitNumPackets)
+    if (expected < kLimitNumPackets) {
+      // Accumulate reports.
+      expected_packets_since_last_loss_update_ = expected;
+      lost_packets_since_last_loss_update_ += packets_lost;
       return;
+    }
 
     has_decreased_since_last_fraction_loss_ = false;
-    int64_t lost_q8 = lost_packets_since_last_loss_update_ << 8;
-    int64_t expected = expected_packets_since_last_loss_update_;
+    int64_t lost_q8 = (lost_packets_since_last_loss_update_ + packets_lost)
+                      << 8;
     last_fraction_loss_ = std::min<int>(lost_q8 / expected, 255);
 
     // Reset accumulators.
-
     lost_packets_since_last_loss_update_ = 0;
     expected_packets_since_last_loss_update_ = 0;
     last_loss_packet_report_ = at_time;

modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.h

diff --git a/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.h b/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.h
index ca42a9d..3fa8c4b 100644
--- a/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.h
+++ b/modules/congestion_controller/goog_cc/send_side_bandwidth_estimation.h
@@ -99,8 +99,8 @@
   void UpdateDelayBasedEstimate(Timestamp at_time, DataRate bitrate);
 
   // Call when we receive a RTCP message with a ReceiveBlock.
-  void UpdatePacketsLost(int packets_lost,
-                         int number_of_packets,
+  void UpdatePacketsLost(int64_t packets_lost,
+                         int64_t number_of_packets,
                          Timestamp at_time);
 
   // Call when we receive a RTCP message with a ReceiveBlock.