Prevent OOB reads in FEC packets without complete RED headers.

webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 383 matching lines @@
                                       0x29,
                                       0x12,
                                       0x2a,
                                       0x98,
                                       0xe0,
                                       0x29};
 
   SurvivesMaliciousPacket(kTruncatedPacket, sizeof(kTruncatedPacket), 100);
 }
 
+TEST_F(ReceiverFecTest, TruncatedPacketWithFBitSetEndingAfterFirstRedHeader) {
+  const uint8_t kPacket[] = {0xa9,
+                             0x27,
+                             0x3a,
+                             0x83,
+                             0x27,
+                             0x3a,
+                             0x3a,
+                             0xf3,
+                             0x67,
+                             0xbe,
+                             0x2a,
+                             0xa9,
+                             0x27,
+                             0x54,
+                             0x3a,
+                             0x3a,
+                             0x2a,
+                             0x67,
+                             0x3a,
+                             0xf3,
+                             0x67,
+                             0xbe,
+                             0x2a,
+                             0x27,
+                             0xe6,
+                             0xf6,
+                             0x03,
+                             0x3e,
+                             0x29,
+                             0x27,
+                             0x21,
+                             0x27,
+                             0x2a,
+                             0x29,
+                             0x21,
+                             0x4b,
+                             0x29,
+                             0x3a,
+                             0x28,
+                             0x29,
+                             0xbf,
+                             0x29,
+                             0x2a,
+                             0x26,
+                             0x29,
+                             0xae,
+                             0x27,
+                             0xa6,
+                             0xf6,
+                             0x00,
+                             0x03,
+                             0x3e};
+  SurvivesMaliciousPacket(kPacket, sizeof(kPacket), 100);
+}
+
+TEST_F(ReceiverFecTest, TruncatedPacketWithoutDataPastFirstBlock) {
+  const uint8_t kPacket[] = {0x82,
+                             0x38,
+                             0x92,
+                             0x38,
+                             0x92,
+                             0x38,
+                             0xde,
+                             0x2a,
+                             0x11,
+                             0xc8,
+                             0xa3,
+                             0xc4,
+                             0x82,
+                             0x38,
+                             0x2a,
+                             0x21,
+                             0x2a,
+                             0x28,
+                             0x92,
+                             0x38,
+                             0x92,
+                             0x00,
+                             0x00,
+                             0x0a,
+                             0x3a,
+                             0xc8,
+                             0xa3,
+                             0x3a,
+                             0x27,
+                             0xc4,
+                             0x2a,
+                             0x21,
+                             0x2a,
+                             0x28};
+  SurvivesMaliciousPacket(kPacket, sizeof(kPacket), 100);
+}
+
 }  // namespace webrtc