Fix crash parsing malformed rtp packet
where header extesnsion size mismatch expected.
BUG=chromium:620242
R=asapersson@webrtc.org
Review URL: https://codereview.webrtc.org/2067793003 .
Cr-Original-Commit-Position: refs/heads/master@{#13170}
Cr-Mirrored-From: https://chromium.googlesource.com/external/webrtc
Cr-Mirrored-Commit: 5a45fe6fd7a509fb4c3a9b09cdbd2278055f1d4c
diff --git a/modules/rtp_rtcp/source/rtp_packet.cc b/modules/rtp_rtcp/source/rtp_packet.cc
index f663486..07aeb71 100644
--- a/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/modules/rtp_rtcp/source/rtp_packet.cc
@@ -416,10 +416,13 @@
RTC_DCHECK(offset);
for (size_t i = 0; i < num_extensions_; ++i) {
if (extension_entries_[i].type == type) {
- RTC_CHECK_EQ(length, extension_entries_[i].length)
- << "Length mismatch for extension '" << type << "'"
- << "should be " << length << ", received "
- << extension_entries_[i].length;
+ if (length != extension_entries_[i].length) {
+ LOG(LS_WARNING) << "Length mismatch for extension '" << type
+ << "': expected " << static_cast<int>(length)
+ << ", received "
+ << static_cast<int>(extension_entries_[i].length);
+ return false;
+ }
*offset = extension_entries_[i].offset;
return true;
}
diff --git a/modules/rtp_rtcp/source/rtp_packet_unittest.cc b/modules/rtp_rtcp/source/rtp_packet_unittest.cc
index b992d2d..28c124a 100644
--- a/modules/rtp_rtcp/source/rtp_packet_unittest.cc
+++ b/modules/rtp_rtcp/source/rtp_packet_unittest.cc
@@ -31,6 +31,7 @@
constexpr bool kVoiceActive = true;
constexpr uint8_t kAudioLevel = 0x5a;
constexpr size_t kMaxPaddingSize = 224u;
+// clang-format off
constexpr uint8_t kMinimumPacket[] = {
0x80, kPayloadType, 0x00, kSeqNum,
0x65, 0x43, 0x12, 0x78,
@@ -63,7 +64,7 @@
0x12, 0x00, 0x56, 0xce,
'p', 'a', 'y', 'l', 'o', 'a', 'd',
'p', 'a', 'd', 'd', 'i', 'n', 'g', kPacketPaddingSize};
-
+// clang-format on
} // namespace
TEST(RtpPacketTest, CreateMinimum) {
@@ -193,6 +194,36 @@
EXPECT_EQ(0u, packet.padding_size());
}
+TEST(RtpPacketTest, ParseWithInvalidSizedExtension) {
+ // clang-format off
+ constexpr uint8_t kBadPacket[] = {
+ 0x90, kPayloadType, 0x00, kSeqNum,
+ 0x65, 0x43, 0x12, 0x78, // kTimestamp.
+ 0x12, 0x34, 0x56, 0x78, // kSSrc.
+ 0xbe, 0xde, 0x00, 0x02, // Extension block of size 2 x 32bit words.
+ (kTransmissionOffsetExtensionId << 4) | 6, // (6+1)-byte extension, but
+ 'e', 'x', 't', // Transmission Offset
+ 'd', 'a', 't', 'a', // expected to be 3-bytes.
+ 'p', 'a', 'y', 'l', 'o', 'a', 'd',
+ };
+ // clang-format on
+
+ RtpPacketToSend::ExtensionManager extensions;
+ extensions.Register(kRtpExtensionTransmissionTimeOffset,
+ kTransmissionOffsetExtensionId);
+
+ RtpPacketReceived packet(&extensions);
+ EXPECT_TRUE(packet.Parse(kBadPacket, sizeof(kBadPacket)));
+
+ // Extension should be ignored.
+ int32_t time_offset;
+ EXPECT_FALSE(packet.GetExtension<TransmissionOffset>(&time_offset));
+
+ // But shouldn't prevent reading payload.
+ EXPECT_THAT(make_tuple(packet.payload(), packet.payload_size()),
+ ElementsAreArray(kPayload));
+}
+
TEST(RtpPacketTest, ParseWith2Extensions) {
RtpPacketToSend::ExtensionManager extensions;
extensions.Register(kRtpExtensionTransmissionTimeOffset,
