commit c3d937b3e4435b96560613ec0a5ea9760e896883
author Danil Chapovalov <danilchap@webrtc.org> Tue Feb 27 16:51:42 2024
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Feb 27 21:44:37 2024
tree e917912bb7242623234cb7b0cb76a2d53953c4e8
parent 8cd50cbbdc380d38ef29adb57d8e6e0b7173d7f3

In RtpFrameReferenceFinder discard frames with too large spatial id

Bug: chromium:41495253
Change-Id: I681f64edfcba319ab9479a2ad10987452cf9b6d4
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/341265
Reviewed-by: Philip Eliasson <philipel@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#41829}

modules/video_coding/BUILD.gn

diff --git a/modules/video_coding/BUILD.gn b/modules/video_coding/BUILD.gn
index e1aa757..eec1e66 100644
--- a/modules/video_coding/BUILD.gn
+++ b/modules/video_coding/BUILD.gn
@@ -233,6 +233,7 @@
     "../../api/video:video_bitrate_allocation",
     "../../api/video:video_bitrate_allocator",
     "../../api/video:video_bitrate_allocator_factory",
+    "../../api/video:video_codec_constants",
     "../../api/video:video_frame",
     "../../api/video:video_frame_type",
     "../../api/video:video_rtp_headers",

modules/video_coding/rtp_generic_ref_finder.cc

diff --git a/modules/video_coding/rtp_generic_ref_finder.cc b/modules/video_coding/rtp_generic_ref_finder.cc
index fd5b8af..503a792 100644
--- a/modules/video_coding/rtp_generic_ref_finder.cc
+++ b/modules/video_coding/rtp_generic_ref_finder.cc
@@ -12,6 +12,7 @@
 
 #include <utility>
 
+#include "api/video/video_codec_constants.h"
 #include "rtc_base/logging.h"
 
 namespace webrtc {
@@ -19,6 +20,13 @@
 RtpFrameReferenceFinder::ReturnVector RtpGenericFrameRefFinder::ManageFrame(
     std::unique_ptr<RtpFrameObject> frame,
     const RTPVideoHeader::GenericDescriptorInfo& descriptor) {
+  RtpFrameReferenceFinder::ReturnVector res;
+  if (descriptor.spatial_index >= kMaxSpatialLayers) {
+    RTC_LOG(LS_WARNING) << "Spatial index " << descriptor.spatial_index
+                        << " is unsupported.";
+    return res;
+  }
+
   // Frame IDs are unwrapped in the RtpVideoStreamReceiver, no need to unwrap
   // them here.
   frame->SetId(descriptor.frame_id);
@@ -26,7 +34,6 @@
   if (descriptor.temporal_index != kNoTemporalIdx)
     frame->SetTemporalIndex(descriptor.temporal_index);
 
-  RtpFrameReferenceFinder::ReturnVector res;
   if (EncodedFrame::kMaxFrameReferences < descriptor.dependencies.size()) {
     RTC_LOG(LS_WARNING) << "Too many dependencies in generic descriptor.";
     return res;