Relanding https://codereview.webrtc.org/1715883002/ in pieces.

webrtc/media/engine/webrtcvoiceengine.cc

 /*
  *  Copyright (c) 2004 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 81 matching lines @@
 // See http://tools.ietf.org/html/rfc2474 for details.
 // See also http://tools.ietf.org/html/draft-jennings-rtcweb-qos-00
 const rtc::DiffServCodePoint kAudioDscpValue = rtc::DSCP_EF;
 
 // Constants from voice_engine_defines.h.
 const int kMinTelephoneEventCode = 0;           // RFC4733 (Section 2.3.1)
 const int kMaxTelephoneEventCode = 255;
 const int kMinTelephoneEventDuration = 100;
 const int kMaxTelephoneEventDuration = 60000;   // Actual limit is 2^16
 
+const int kMinPayloadType = 0;
+const int kMaxPayloadType = 127;
+
 class ProxySink : public webrtc::AudioSinkInterface {
  public:
   ProxySink(AudioSinkInterface* sink) : sink_(sink) { RTC_DCHECK(sink); }
 
   void OnData(const Data& audio) override { sink_->OnData(audio); }
 
  private:
   webrtc::AudioSinkInterface* sink_;
 };
 
@@ skipping 1430 matching lines @@
 }
 
 // Utility function called from SetSendParameters() to extract current send
 // codec settings from the given list of codecs (originally from SDP). Both send
 // and receive streams may be reconfigured based on the new settings.
 bool WebRtcVoiceMediaChannel::SetSendCodecs(
     const std::vector<AudioCodec>& codecs) {
   RTC_DCHECK(worker_thread_checker_.CalledOnValidThread());
   // TODO(solenberg): Validate input - that payload types don't overlap, are
   //                  within range, filter out codecs we don't support,
-  //                  redundant codecs etc.
+  //                  redundant codecs etc - the same way it is done for
+  //                  RtpHeaderExtensions.
 
   // Find the DTMF telephone event "codec" payload type.
   dtmf_payload_type_ = rtc::Optional<int>();
   for (const AudioCodec& codec : codecs) {
     if (IsCodec(codec, kDtmfCodecName)) {
+      if (codec.id < kMinPayloadType || codec.id > kMaxPayloadType) {
+        return false;
+      }
       dtmf_payload_type_ = rtc::Optional<int>(codec.id);
       break;
     }
   }
 
   // Scan through the list to figure out the codec to use for sending, along
   // with the proper configuration for VAD, CNG, RED, NACK and Opus-specific
   // parameters.
   {
     SendCodecSpec send_codec_spec;
@@ skipping 967 matching lines @@
     }
   } else {
     LOG(LS_INFO) << "Stopping playout for channel #" << channel;
     engine()->voe()->base()->StopPlayout(channel);
   }
   return true;
 }
 }  // namespace cricket
 
 #endif  // HAVE_WEBRTC_VOICE