Fail RTP parsing on excessive padding length.

webrtc/modules/rtp_rtcp/source/rtp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 337 matching lines @@
     }
     if (definedByProfile == kRtpOneByteHeaderExtensionId) {
       const uint8_t* ptrRTPDataExtensionEnd = ptr + XLen;
       ParseOneByteExtensionHeader(header,
                                   ptrExtensionMap,
                                   ptrRTPDataExtensionEnd,
                                   ptr);
     }
     header.headerLength += XLen;
   }
+  if (header.headerLength + header.paddingLength > static_cast<size_t>(length))
+    return false;
   return true;
 }
 
 void RtpHeaderParser::ParseOneByteExtensionHeader(
     RTPHeader& header,
     const RtpHeaderExtensionMap* ptrExtensionMap,
     const uint8_t* ptrRTPDataExtensionEnd,
     const uint8_t* ptr) const {
   if (!ptrExtensionMap) {
     return;
@@ skipping 134 matching lines @@
       return num_zero_bytes;
     }
     ptr++;
     num_zero_bytes++;
   }
   return num_zero_bytes;
 }
 }  // namespace RtpUtility
 
 }  // namespace webrtc