Prevent out-of-bounds reads for short FEC packets.

webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc

Index: webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
diff --git a/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc b/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
index 9d9550b0b1bf966d667604df42866cb27af7760b..cfb9279c22051b25295be72ae04e3b5206770cac 100644
--- a/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
+++ b/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
@@ -81,6 +81,11 @@ int32_t FecReceiverImpl::AddReceivedRedPacket(
   uint8_t REDHeaderLength = 1;
   size_t payload_data_length = packet_length - header.headerLength;
 
+  if (payload_data_length == 0) {
+    LOG(LS_WARNING) << "Corrupt/truncated FEC packet.";
+    return -1;
+  }
+
   // Add to list without RED header, aka a virtual RTP packet
   // we remove the RED header
 
@@ -99,14 +104,18 @@ int32_t FecReceiverImpl::AddReceivedRedPacket(
   if (incoming_rtp_packet[header.headerLength] & 0x80) {
     // f bit set in RED header
     REDHeaderLength = 4;
+    if (payload_data_length < REDHeaderLength) {
+      LOG(LS_WARNING) << "Corrupt/truncated FEC packet.";
+      delete received_packet;
+      return -1;
+    }
+
     uint16_t timestamp_offset =
         (incoming_rtp_packet[header.headerLength + 1]) << 8;
     timestamp_offset +=
         incoming_rtp_packet[header.headerLength + 2];
     timestamp_offset = timestamp_offset >> 2;
     if (timestamp_offset != 0) {
-      // |timestampOffset| should be 0. However, it's possible this is the first
-      // location a corrupt payload can be caught, so don't assert.
       LOG(LS_WARNING) << "Corrupt payload found.";
       delete received_packet;
       return -1;
@@ -118,15 +127,13 @@ int32_t FecReceiverImpl::AddReceivedRedPacket(
 
     // check next RED header
     if (incoming_rtp_packet[header.headerLength + 4] & 0x80) {
-      // more than 2 blocks in packet not supported
+      LOG(LS_WARNING) << "More than 2 blocks in packet not supported.";
       delete received_packet;
-      assert(false);
       return -1;
     }
     if (blockLength > payload_data_length - REDHeaderLength) {
-      // block length longer than packet
+      LOG(LS_WARNING) << "Block length longer than packet.";
       delete received_packet;
-      assert(false);
       return -1;
     }
   }