Prevent OOB reads in FEC packets without complete RED headers.

webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 86 matching lines @@
   uint8_t payload_type =
       incoming_rtp_packet[header.headerLength] & 0x7f;
 
   received_packet->is_fec = payload_type == ulpfec_payload_type;
   received_packet->seq_num = header.sequenceNumber;
 
   uint16_t blockLength = 0;
   if (incoming_rtp_packet[header.headerLength] & 0x80) {
     // f bit set in RED header
     REDHeaderLength = 4;
-    if (payload_data_length < REDHeaderLength) {
+    if (payload_data_length < REDHeaderLength + 1u) {
       LOG(LS_WARNING) << "Corrupt/truncated FEC packet.";
       return -1;
     }
 
     uint16_t timestamp_offset =
         (incoming_rtp_packet[header.headerLength + 1]) << 8;
     timestamp_offset +=
         incoming_rtp_packet[header.headerLength + 2];
     timestamp_offset = timestamp_offset >> 2;
     if (timestamp_offset != 0) {
       LOG(LS_WARNING) << "Corrupt payload found.";
       return -1;
     }
 
     blockLength =
         (0x03 & incoming_rtp_packet[header.headerLength + 2]) << 8;
     blockLength += (incoming_rtp_packet[header.headerLength + 3]);
 
     // check next RED header
     if (incoming_rtp_packet[header.headerLength + 4] & 0x80) {
       LOG(LS_WARNING) << "More than 2 blocks in packet not supported.";
       return -1;
     }
-    if (blockLength > payload_data_length - REDHeaderLength) {
+    // Check that the packet is long enough to contain data in the following
+    // block.
+    if (blockLength > payload_data_length - (REDHeaderLength + 1)) {
       LOG(LS_WARNING) << "Block length longer than packet.";
       return -1;
     }
   }
   ++packet_counter_.num_packets;
 
   rtc::scoped_ptr<ForwardErrorCorrection::ReceivedPacket>
       second_received_packet;
   if (blockLength > 0) {
     // handle block length, split into 2 packets
@@ skipping 108 matching lines @@
       return -1;
     }
     crit_sect_->Enter();
     (*it)->returned = true;
   }
   crit_sect_->Leave();
   return 0;
 }
 
 }  // namespace webrtc