commit f6b4056ca5e125c8e08c0591023c13aae3249a74
author Ivo Creusen <ivoc@webrtc.org> Tue Sep 07 20:54:24 2021
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Sep 07 22:42:27 2021
tree 6205069026d393f56e0c3757bd40cfe26b73f8bf
parent f6c6b4a831e8a495d3ec656f60f4aab708a46876

Avoid accessing uninitialized memory when RTCP block fails to parse.

The HandleXr method has output arguments that are not set when an RTCP
report cannot be parsed. We should give these a sensible default value
to avoid accessing uninitialized memory

Bug: chromium:1247182
Change-Id: I6c54260aef3834643c41b96c0709489522d82533
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/231237
Commit-Queue: Ivo Creusen <ivoc@webrtc.org>
Reviewed-by: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#34943}

modules/rtp_rtcp/source/rtcp_receiver.cc

diff --git a/modules/rtp_rtcp/source/rtcp_receiver.cc b/modules/rtp_rtcp/source/rtcp_receiver.cc
index e64b693..47843be 100644
--- a/modules/rtp_rtcp/source/rtcp_receiver.cc
+++ b/modules/rtp_rtcp/source/rtcp_receiver.cc
@@ -482,14 +482,15 @@
       case rtcp::Sdes::kPacketType:
         HandleSdes(rtcp_block, packet_information);
         break;
-      case rtcp::ExtendedReports::kPacketType:
-        bool contains_dlrr;
-        uint32_t ssrc;
+      case rtcp::ExtendedReports::kPacketType: {
+        bool contains_dlrr = false;
+        uint32_t ssrc = 0;
         HandleXr(rtcp_block, packet_information, contains_dlrr, ssrc);
         if (contains_dlrr) {
           received_blocks[ssrc].dlrr = true;
         }
         break;
+      }
       case rtcp::Bye::kPacketType:
         HandleBye(rtcp_block);
         break;