Prevent OOB reads in FEC packets without complete RED headers.

webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc

Index: webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc
diff --git a/webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc b/webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc
index 3cd2a9e462635c4aa13c654c92da7322c900fb7d..cc5d65c97505ed8711f465629578de7fecd5255a 100644
--- a/webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc
+++ b/webrtc/modules/rtp_rtcp/source/fec_receiver_unittest.cc
@@ -401,4 +401,98 @@ TEST_F(ReceiverFecTest, TruncatedPacketWithFBitSet) {
   SurvivesMaliciousPacket(kTruncatedPacket, sizeof(kTruncatedPacket), 100);
 }
 
+TEST_F(ReceiverFecTest, TruncatedPacketWithFBitSetEndingAfterFirstRedHeader) {
+  const uint8_t kPacket[] = {0xa9,
+                             0x27,
+                             0x3a,
+                             0x83,
+                             0x27,
+                             0x3a,
+                             0x3a,
+                             0xf3,
+                             0x67,
+                             0xbe,
+                             0x2a,
+                             0xa9,
+                             0x27,
+                             0x54,
+                             0x3a,
+                             0x3a,
+                             0x2a,
+                             0x67,
+                             0x3a,
+                             0xf3,
+                             0x67,
+                             0xbe,
+                             0x2a,
+                             0x27,
+                             0xe6,
+                             0xf6,
+                             0x03,
+                             0x3e,
+                             0x29,
+                             0x27,
+                             0x21,
+                             0x27,
+                             0x2a,
+                             0x29,
+                             0x21,
+                             0x4b,
+                             0x29,
+                             0x3a,
+                             0x28,
+                             0x29,
+                             0xbf,
+                             0x29,
+                             0x2a,
+                             0x26,
+                             0x29,
+                             0xae,
+                             0x27,
+                             0xa6,
+                             0xf6,
+                             0x00,
+                             0x03,
+                             0x3e};
+  SurvivesMaliciousPacket(kPacket, sizeof(kPacket), 100);
+}
+
+TEST_F(ReceiverFecTest, TruncatedPacketWithoutDataPastFirstBlock) {
+  const uint8_t kPacket[] = {0x82,
+                             0x38,
+                             0x92,
+                             0x38,
+                             0x92,
+                             0x38,
+                             0xde,
+                             0x2a,
+                             0x11,
+                             0xc8,
+                             0xa3,
+                             0xc4,
+                             0x82,
+                             0x38,
+                             0x2a,
+                             0x21,
+                             0x2a,
+                             0x28,
+                             0x92,
+                             0x38,
+                             0x92,
+                             0x00,
+                             0x00,
+                             0x0a,
+                             0x3a,
+                             0xc8,
+                             0xa3,
+                             0x3a,
+                             0x27,
+                             0xc4,
+                             0x2a,
+                             0x21,
+                             0x2a,
+                             0x28};
+  SurvivesMaliciousPacket(kPacket, sizeof(kPacket), 100);
+}
+
 }  // namespace webrtc