Prevent OOB reads for truncated H264 STAP-A packets.

webrtc/modules/video_coding/main/source/session_info.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 115 matching lines @@
   for (it = packets_.begin(); it != packet_it; ++it)
     offset += (*it).sizeBytes;
 
   // Set the data pointer to pointing to the start of this packet in the
   // frame buffer.
   const uint8_t* packet_buffer = packet.dataPtr;
   packet.dataPtr = frame_buffer + offset;
 
   // We handle H.264 STAP-A packets in a special way as we need to remove the
   // two length bytes between each NAL unit, and potentially add start codes.
+  // TODO(pbos): Remove H264 parsing from this step and use a fragmentation
+  // header supplied by the H264 depacketizer.
   const size_t kH264NALHeaderLengthInBytes = 1;
   const size_t kLengthFieldLength = 2;
   if (packet.codecSpecificHeader.codec == kRtpVideoH264 &&
       packet.codecSpecificHeader.codecHeader.H264.packetization_type ==
           kH264StapA) {
     size_t required_length = 0;
     const uint8_t* nalu_ptr = packet_buffer + kH264NALHeaderLengthInBytes;
     while (nalu_ptr < packet_buffer + packet.sizeBytes) {
       size_t length = BufferToUWord16(nalu_ptr);
       required_length +=
@@ skipping 384 matching lines @@
   if (empty_seq_num_high_ == -1)
     empty_seq_num_high_ = seq_num;
   else
     empty_seq_num_high_ = LatestSequenceNumber(seq_num, empty_seq_num_high_);
   if (empty_seq_num_low_ == -1 || IsNewerSequenceNumber(empty_seq_num_low_,
                                                         seq_num))
     empty_seq_num_low_ = seq_num;
 }
 
 }  // namespace webrtc