Prevent out-of-bounds reads for short FEC packets.

webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include <string.h>
 
 #include <list>
 
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "webrtc/base/scoped_ptr.h"
 #include "webrtc/modules/rtp_rtcp/interface/fec_receiver.h"
+#include "webrtc/modules/rtp_rtcp/interface/rtp_header_parser.h"
 #include "webrtc/modules/rtp_rtcp/mocks/mock_rtp_rtcp.h"
 #include "webrtc/modules/rtp_rtcp/source/fec_test_helper.h"
 #include "webrtc/modules/rtp_rtcp/source/forward_error_correction.h"
 
 using ::testing::_;
 using ::testing::Args;
 using ::testing::ElementsAreArray;
 using ::testing::Return;
 
 namespace webrtc {
@@ skipping 45 matching lines @@
   }
 
   void BuildAndAddRedFecPacket(Packet* packet) {
     RtpPacket* red_packet = generator_->BuildFecRedPacket(packet);
     EXPECT_EQ(0, receiver_fec_->AddReceivedRedPacket(
                      red_packet->header.header, red_packet->data,
                      red_packet->length, kFecPayloadType));
     delete red_packet;
   }
 
+  static void SurvivesMaliciousPacket(const uint8_t* data,
+                                      size_t length,
+                                      uint8_t ulpfec_payload_type);
+
   MockRtpData rtp_data_callback_;
   rtc::scoped_ptr<ForwardErrorCorrection> fec_;
   rtc::scoped_ptr<FecReceiver> receiver_fec_;
   rtc::scoped_ptr<FrameGenerator> generator_;
 };
 
 void DeletePackets(std::list<Packet*>* packets) {
   while (!packets->empty()) {
     delete packets->front();
     packets->pop_front();
@@ skipping 261 matching lines @@
   // and should've been dropped. Only the media packet we inserted will be
   // returned.
   BuildAndAddRedMediaPacket(media_rtp_packets.front());
   EXPECT_CALL(rtp_data_callback_, OnRecoveredPacket(_, _))
       .Times(1).WillRepeatedly(Return(true));
   EXPECT_EQ(0, receiver_fec_->ProcessReceivedFec());
 
   DeletePackets(&media_packets);
 }
 
+void ReceiverFecTest::SurvivesMaliciousPacket(const uint8_t* data,
+                                              size_t length,
+                                              uint8_t ulpfec_payload_type) {
+  webrtc::RTPHeader header;
+  rtc::scoped_ptr<webrtc::RtpHeaderParser> parser(
+      webrtc::RtpHeaderParser::Create());
+  ASSERT_TRUE(parser->Parse(data, length, &header));
+
+  webrtc::NullRtpData null_callback;
+  rtc::scoped_ptr<webrtc::FecReceiver> receiver_fec(
+      webrtc::FecReceiver::Create(&null_callback));
+
+  receiver_fec->AddReceivedRedPacket(header, data, length, ulpfec_payload_type);
+}
+
+TEST_F(ReceiverFecTest, TruncatedPacketWithFBitSet) {
+  const uint8_t kTruncatedPacket[] = {0x80,
+                                      0x2a,
+                                      0x68,
+                                      0x71,
+                                      0x29,
+                                      0xa1,
+                                      0x27,
+                                      0x3a,
+                                      0x29,
+                                      0x12,
+                                      0x2a,
+                                      0x98,
+                                      0xe0,
+                                      0x29};
+
+  SurvivesMaliciousPacket(kTruncatedPacket, sizeof(kTruncatedPacket), 100);
+}
+
 }  // namespace webrtc