Prevent OOB reads for truncated H264 STAP-A packets.

Prevent OOB reads for truncated H264 STAP-A packets.

BUG=webrtc:4771, webrtc:4834
R=stefan@webrtc.org

Committed: https://crrev.com/f1828e8ed96ae1aa3ea9dc1eb96e2e703d2e78cf
Cr-Commit-Position: refs/heads/master@{#9650}

[pbos-webrtc, 2015-07-17 14:08:53]

PTAL

https://codereview.webrtc.org/1238033003/diff/1/webrtc/modules/video_coding/m...
File webrtc/modules/video_coding/main/source/session_info.cc (right):

https://codereview.webrtc.org/1238033003/diff/1/webrtc/modules/video_coding/m...
webrtc/modules/video_coding/main/source/session_info.cc:163: packet->sizeBytes =
required_length - kH264NALHeaderLengthInBytes;
Was this part (not including kH264NALHeaderLengthInBytes) correct before? This
should be a no-op now since kH264NALHeaderLengthInBytes is added at line 142.

[pbos-webrtc, 2015-07-17 14:08:59]

The CQ bit was checked by pbos@webrtc.org to run a CQ dry run

[commit-bot: I haz the power, 2015-07-17 14:09:08]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1238033003/1

[commit-bot: I haz the power, 2015-07-17 14:18:08]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-07-17 14:18:09]

Dry run: Try jobs failed on following builders:
  linux on tryserver.webrtc (JOB_FAILED,
http://build.chromium.org/p/tryserver.webrtc/builders/linux/builds/8622)

(exceeded global retry quota)

[stefan-webrtc, 2015-07-23 12:36:04]

https://codereview.webrtc.org/1238033003/diff/1/webrtc/modules/video_coding/m...
File webrtc/modules/video_coding/main/source/session_info.cc (right):

https://codereview.webrtc.org/1238033003/diff/1/webrtc/modules/video_coding/m...
webrtc/modules/video_coding/main/source/session_info.cc:147: length +
(packet->insertStartCode ? kH264StartCodeLengthBytes : 0);
As discussed, the problem is that this start code overflows the packet size. We
have to take into account the number of nal units when allocating the frame
buffer size in frame_buffer.cc.

[pbos-webrtc, 2015-07-28 14:01:10]

verify stap-a nalu lengths in parser

[pbos-webrtc, 2015-07-28 14:16:05]

fix

[pbos-webrtc, 2015-07-28 14:17:55]

PTAL, the incorrect accounting for NALU headers in frame_buffer.cc should be in
a follow-up CL. I'd like to keep those separate but get this in to continue
fuzzing.

[stefan-webrtc, 2015-07-28 14:22:19]

lgtm, but fix the comments

https://codereview.webrtc.org/1238033003/diff/40001/webrtc/modules/rtp_rtcp/s...
File webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc (right):

https://codereview.webrtc.org/1238033003/diff/40001/webrtc/modules/rtp_rtcp/s...
webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc:44: while (length_remaining >
0) {
Add a TODO to not parse this twice (here and in the JB)

https://codereview.webrtc.org/1238033003/diff/40001/webrtc/modules/rtp_rtcp/s...
webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc:78: if
(!VerifyStapANaluLengths(nalu_start, nalu_length))
Log this?

[pbos-webrtc, 2015-07-28 14:29:01]

added logging + todos

[pbos-webrtc, 2015-07-28 14:29:06]

The CQ bit was checked by pbos@webrtc.org

[pbos-webrtc, 2015-07-28 14:29:06]

The patchset sent to the CQ was uploaded after l-g-t-m from stefan@webrtc.org
Link to the patchset: https://codereview.webrtc.org/1238033003/#ps60001 (title:
"added logging + todos")

[commit-bot: I haz the power, 2015-07-28 14:29:12]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1238033003/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1238033003/60001

[commit-bot: I haz the power, 2015-07-28 15:21:03]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2015-07-28 15:21:13]

Patchset 4 (id:??) landed as
https://crrev.com/f1828e8ed96ae1aa3ea9dc1eb96e2e703d2e78cf
Cr-Commit-Position: refs/heads/master@{#9650}