Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(320)

Side by Side Diff: webrtc/modules/rtp_rtcp/source/rtp_format_video_generic.cc

Issue 1218013002: Prevent OOB reads for zero-length H264 payloads. (Closed) Base URL: https://chromium.googlesource.com/external/webrtc.git@master
Patch Set: Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (c) 2014 The WebRTC project authors. All Rights Reserved. 2 * Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license 4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source 5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found 6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may 7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree. 8 * be found in the AUTHORS file in the root of the source tree.
9 */ 9 */
10 10
11 #include <string> 11 #include <string>
12 12
13 #include "webrtc/base/logging.h"
13 #include "webrtc/modules/interface/module_common_types.h" 14 #include "webrtc/modules/interface/module_common_types.h"
14 #include "webrtc/modules/rtp_rtcp/source/rtp_format_video_generic.h" 15 #include "webrtc/modules/rtp_rtcp/source/rtp_format_video_generic.h"
15 16
16 namespace webrtc { 17 namespace webrtc {
17 18
18 static const size_t kGenericHeaderLength = 1; 19 static const size_t kGenericHeaderLength = 1;
19 20
20 RtpPacketizerGeneric::RtpPacketizerGeneric(FrameType frame_type, 21 RtpPacketizerGeneric::RtpPacketizerGeneric(FrameType frame_type,
21 size_t max_payload_len) 22 size_t max_payload_len)
22 : payload_data_(NULL), 23 : payload_data_(NULL),
(...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after
83 } 84 }
84 85
85 std::string RtpPacketizerGeneric::ToString() { 86 std::string RtpPacketizerGeneric::ToString() {
86 return "RtpPacketizerGeneric"; 87 return "RtpPacketizerGeneric";
87 } 88 }
88 89
89 bool RtpDepacketizerGeneric::Parse(ParsedPayload* parsed_payload, 90 bool RtpDepacketizerGeneric::Parse(ParsedPayload* parsed_payload,
90 const uint8_t* payload_data, 91 const uint8_t* payload_data,
91 size_t payload_data_length) { 92 size_t payload_data_length) {
92 assert(parsed_payload != NULL); 93 assert(parsed_payload != NULL);
94 if (payload_data_length == 0) {
95 LOG(LS_ERROR) << "Empty payload.";
96 return false;
97 }
93 98
94 uint8_t generic_header = *payload_data++; 99 uint8_t generic_header = *payload_data++;
95 --payload_data_length; 100 --payload_data_length;
96 101
97 parsed_payload->frame_type = 102 parsed_payload->frame_type =
98 ((generic_header & RtpFormatVideoGeneric::kKeyFrameBit) != 0) 103 ((generic_header & RtpFormatVideoGeneric::kKeyFrameBit) != 0)
99 ? kVideoFrameKey 104 ? kVideoFrameKey
100 : kVideoFrameDelta; 105 : kVideoFrameDelta;
101 parsed_payload->type.Video.isFirstPacket = 106 parsed_payload->type.Video.isFirstPacket =
102 (generic_header & RtpFormatVideoGeneric::kFirstPacketBit) != 0; 107 (generic_header & RtpFormatVideoGeneric::kFirstPacketBit) != 0;
103 parsed_payload->type.Video.codec = kRtpVideoGeneric; 108 parsed_payload->type.Video.codec = kRtpVideoGeneric;
104 parsed_payload->type.Video.width = 0; 109 parsed_payload->type.Video.width = 0;
105 parsed_payload->type.Video.height = 0; 110 parsed_payload->type.Video.height = 0;
106 111
107 parsed_payload->payload = payload_data; 112 parsed_payload->payload = payload_data;
108 parsed_payload->payload_length = payload_data_length; 113 parsed_payload->payload_length = payload_data_length;
109 return true; 114 return true;
110 } 115 }
111 } // namespace webrtc 116 } // namespace webrtc
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698