Prevent OOB reads in FEC packets without complete RED headers.

webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc

Index: webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
diff --git a/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc b/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
index ce240860a5881cf6b2260054611db071f7e2b9de..e2de1b1101376d17e3ac034e067c9257df4e00de 100644
--- a/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
+++ b/webrtc/modules/rtp_rtcp/source/fec_receiver_impl.cc
@@ -104,7 +104,7 @@ int32_t FecReceiverImpl::AddReceivedRedPacket(
   if (incoming_rtp_packet[header.headerLength] & 0x80) {
     // f bit set in RED header
     REDHeaderLength = 4;
-    if (payload_data_length < REDHeaderLength) {
+    if (payload_data_length < REDHeaderLength + 1) {
       LOG(LS_WARNING) << "Corrupt/truncated FEC packet.";
       return -1;
     }
@@ -124,11 +124,13 @@ int32_t FecReceiverImpl::AddReceivedRedPacket(
     blockLength += (incoming_rtp_packet[header.headerLength + 3]);
 
     // check next RED header
-    if (incoming_rtp_packet[header.headerLength + 4] & 0x80) {
+    if (payload_data_length > 4 &&

[stefan-webrtc, 2015/06/29 15:35:32]

Shouldn't we bail out if payload_data_length <= 4? Actually, can
payload_data_length even be <= 4 given that you bail out on line 107?

[pbos-webrtc, 2015/06/29 15:42:44]

It can't, removed.

+        incoming_rtp_packet[header.headerLength + 4] & 0x80) {
       LOG(LS_WARNING) << "More than 2 blocks in packet not supported.";
       return -1;
     }
-    if (blockLength > payload_data_length - REDHeaderLength) {
+    // +1 as we require a following block to contain data.
+    if (blockLength > payload_data_length - (REDHeaderLength + 1)) {

[stefan-webrtc, 2015/06/29 15:35:32]

Is this +1 any different from the one at line 107? If not it's weird to comment
here and not there.

[pbos-webrtc, 2015/06/29 15:42:44]

Nope, not different. I rewrote this comment to match what we're actually
checking.

       LOG(LS_WARNING) << "Block length longer than packet.";
       return -1;
     }