Prevent heap overflows for incorrect FEC packet lengths.

webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include <string.h>
 
 #include <list>
 
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "webrtc/base/scoped_ptr.h"
 #include "webrtc/modules/rtp_rtcp/interface/fec_receiver.h"
 #include "webrtc/modules/rtp_rtcp/interface/rtp_header_parser.h"
 #include "webrtc/modules/rtp_rtcp/mocks/mock_rtp_rtcp.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
 #include "webrtc/modules/rtp_rtcp/source/fec_test_helper.h"
 #include "webrtc/modules/rtp_rtcp/source/forward_error_correction.h"
 
 using ::testing::_;
 using ::testing::Args;
 using ::testing::ElementsAreArray;
 using ::testing::Return;
 
 namespace webrtc {
 
@@ skipping 44 matching lines @@
   }
 
   void BuildAndAddRedFecPacket(Packet* packet) {
     RtpPacket* red_packet = generator_->BuildFecRedPacket(packet);
     EXPECT_EQ(0, receiver_fec_->AddReceivedRedPacket(
                      red_packet->header.header, red_packet->data,
                      red_packet->length, kFecPayloadType));
     delete red_packet;
   }
 
+  void InjectGarbagePacketLength(size_t fec_garbage_offset);
   static void SurvivesMaliciousPacket(const uint8_t* data,
                                       size_t length,
                                       uint8_t ulpfec_payload_type);
 
   MockRtpData rtp_data_callback_;
   rtc::scoped_ptr<ForwardErrorCorrection> fec_;
   rtc::scoped_ptr<FecReceiver> receiver_fec_;
   rtc::scoped_ptr<FrameGenerator> generator_;
 };
 
 void DeletePackets(std::list<Packet*>* packets) {
   while (!packets->empty()) {
     delete packets->front();
     packets->pop_front();
   }
 }
 
 TEST_F(ReceiverFecTest, TwoMediaOneFec) {
   const unsigned int kNumFecPackets = 1u;
   std::list<RtpPacket*> media_rtp_packets;
   std::list<Packet*> media_packets;
   GenerateFrame(2, 0, &media_rtp_packets, &media_packets);
   std::list<Packet*> fec_packets;
   GenerateFEC(&media_packets, &fec_packets, kNumFecPackets);
 
   // Recovery
   std::list<RtpPacket*>::iterator it = media_rtp_packets.begin();
-  std::list<RtpPacket*>::iterator media_it = media_rtp_packets.begin();
-  BuildAndAddRedMediaPacket(*media_it);
+  BuildAndAddRedMediaPacket(*it);
   VerifyReconstructedMediaPacket(*it, 1);
   EXPECT_EQ(0, receiver_fec_->ProcessReceivedFec());
   // Drop one media packet.
   std::list<Packet*>::iterator fec_it = fec_packets.begin();
   BuildAndAddRedFecPacket(*fec_it);
   ++it;
   VerifyReconstructedMediaPacket(*it, 1);
   EXPECT_EQ(0, receiver_fec_->ProcessReceivedFec());
 
   FecPacketCounter counter = receiver_fec_->GetPacketCounter();
   EXPECT_EQ(2U, counter.num_packets);
   EXPECT_EQ(1U, counter.num_fec_packets);
   EXPECT_EQ(1U, counter.num_recovered_packets);
 
   DeletePackets(&media_packets);
 }
 
+void ReceiverFecTest::InjectGarbagePacketLength(size_t fec_garbage_offset) {
+  EXPECT_CALL(rtp_data_callback_, OnRecoveredPacket(_, _))
+      .WillRepeatedly(Return(true));
+
+  const unsigned int kNumFecPackets = 1u;
+  std::list<RtpPacket*> media_rtp_packets;
+  std::list<Packet*> media_packets;
+  GenerateFrame(2, 0, &media_rtp_packets, &media_packets);
+  std::list<Packet*> fec_packets;
+  GenerateFEC(&media_packets, &fec_packets, kNumFecPackets);
+  ByteWriter<uint16_t>::WriteBigEndian(
+      &fec_packets.front()->data[fec_garbage_offset], 0x4711);
+
+  // Recovery
+  std::list<RtpPacket*>::iterator it = media_rtp_packets.begin();
+  BuildAndAddRedMediaPacket(*it);

[stefan-webrtc, 2015/07/02 09:31:25]

This doesn't really do any recovery, right? Can you move line 149 up here?

[pbos-webrtc, 2015/07/02 13:54:55]

Don't even think I should be running it (line 149), updated this segment along
with comment, PTAL.

+
+  EXPECT_EQ(0, receiver_fec_->ProcessReceivedFec());
+  // Drop one media packet.
+  std::list<Packet*>::iterator fec_it = fec_packets.begin();
+  BuildAndAddRedFecPacket(*fec_it);
+  ++it;
+  EXPECT_EQ(0, receiver_fec_->ProcessReceivedFec());
+
+  FecPacketCounter counter = receiver_fec_->GetPacketCounter();
+  EXPECT_EQ(2u, counter.num_packets);
+  EXPECT_EQ(1u, counter.num_fec_packets);
+  EXPECT_EQ(0u, counter.num_recovered_packets);
+
+  DeletePackets(&media_packets);
+}
+
+TEST_F(ReceiverFecTest, InjectGarbageRecoveredPacketLength) {
+  InjectGarbagePacketLength(8);
+}
+
+TEST_F(ReceiverFecTest, InjectGarbagePacketLength) {
+  InjectGarbagePacketLength(10);

[stefan-webrtc, 2015/07/02 09:31:26]

Can you comment on why those offsets are interesting?

[pbos-webrtc, 2015/07/02 13:54:55]

Done, also updated test names to reflect this.

+}
+
 TEST_F(ReceiverFecTest, TwoMediaTwoFec) {
   const unsigned int kNumFecPackets = 2u;
   std::list<RtpPacket*> media_rtp_packets;
   std::list<Packet*> media_packets;
   GenerateFrame(2, 0, &media_rtp_packets, &media_packets);
   std::list<Packet*> fec_packets;
   GenerateFEC(&media_packets, &fec_packets, kNumFecPackets);
 
   // Recovery
   // Drop both media packets.
@@ skipping 348 matching lines @@
                              0x27,
                              0xc4,
                              0x2a,
                              0x21,
                              0x2a,
                              0x28};
   SurvivesMaliciousPacket(kPacket, sizeof(kPacket), 100);
 }
 
 }  // namespace webrtc