Reject stale BUNDLE MIDs missing from descriptions

BundleManager keeps established BUNDLE groups across offers when the new offer does not include BUNDLE groups. ValidateAndMaybeUpdateBundleGroups() can therefore see stale MIDs that are absent from the current description.

Return INVALID_PARAMETER before dereferencing a missing content section while validating rejected BUNDLE groups.

Bug: webrtc:514442582
Change-Id: Ie592b03de7b92d20da6dc08969d7c2f7b79678e0
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/473740
Reviewed-by: Tomas Gunnarsson <tommi@webrtc.org>
Commit-Queue: Boris Tsirkin <btsirkin@meta.com>
Reviewed-by: Harald Alvestrand <hta@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47747}

pc/jsep_transport_controller.cc

diff --git a/pc/jsep_transport_controller.cc b/pc/jsep_transport_controller.cc
index de012e2..e15a03c 100644
--- a/pc/jsep_transport_controller.cc
+++ b/pc/jsep_transport_controller.cc
@@ -1006,6 +1006,11 @@
     if (bundled_content->rejected) {
       for (const auto& content_name : bundle_group->content_names()) {
         auto other_content = description->GetContentByName(content_name);
+        if (!other_content) {
+          return RTCError(RTCErrorType::INVALID_PARAMETER,
+                          "A BUNDLE group contains a MID='" + content_name +
+                              "' matching no m= section.");
+        }
         if (!other_content->rejected) {
           return RTCError(RTCErrorType::INVALID_PARAMETER,
                           "The m= section with mid='" + content_name +

pc/jsep_transport_controller_unittest.cc

diff --git a/pc/jsep_transport_controller_unittest.cc b/pc/jsep_transport_controller_unittest.cc
index d3c4682..e6f8b02 100644
--- a/pc/jsep_transport_controller_unittest.cc
+++ b/pc/jsep_transport_controller_unittest.cc
@@ -2349,6 +2349,32 @@
   EXPECT_EQ(nullptr, transport_controller_->GetDtlsTransport(kDataMid1));
 }
 
+TEST_F(JsepTransportControllerTest,
+       RejectMissingContentInStaleRemoteOfferBundleGroup) {
+  CreateJsepTransportController(JsepTransportController::Config());
+
+  auto local_offer = CreateSessionDescriptionWithBundleGroup();
+  std::unique_ptr<SessionDescription> remote_answer(local_offer->Clone());
+  EXPECT_TRUE(
+      transport_controller_
+          ->SetLocalDescription(SdpType::kOffer, local_offer.get(), nullptr)
+          .ok());
+  EXPECT_TRUE(transport_controller_
+                  ->SetRemoteDescription(SdpType::kAnswer, local_offer.get(),
+                                         remote_answer.get())
+                  .ok());
+
+  auto remote_reoffer = std::make_unique<SessionDescription>();
+  AddAudioSection(remote_reoffer.get(), kAudioMid1, kIceUfrag1, kIcePwd1,
+                  ICEMODE_FULL, CONNECTIONROLE_ACTPASS, nullptr);
+  remote_reoffer->contents()[0].rejected = true;
+
+  RTCError error = transport_controller_->SetRemoteDescription(
+      SdpType::kOffer, local_offer.get(), remote_reoffer.get());
+  EXPECT_FALSE(error.ok());
+  EXPECT_EQ(RTCErrorType::INVALID_PARAMETER, error.type());
+}
+
 // Tests that applying non-RTCP-mux offer would fail when kRtcpMuxPolicyRequire
 // is used.
 TEST_F(JsepTransportControllerTest, ApplyNonRtcpMuxOfferWhenMuxingRequired) {