Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 112 matching lines @@
             break;
           case ParseState::State_RTPFB_TMMBRItem:
             IterateTMMBRItem();
             break;
           case ParseState::State_RTPFB_TMMBNItem:
             IterateTMMBNItem();
             break;
           case ParseState::State_PSFB_SLIItem:
             IterateSLIItem();
             break;
-          case ParseState::State_PSFB_RPSIItem:
-            IterateRPSIItem();
-            break;
           case ParseState::State_PSFB_FIRItem:
             IterateFIRItem();
             break;
           case ParseState::State_PSFB_AppItem:
             IteratePsfbAppItem();
             break;
           case ParseState::State_PSFB_REMBItem:
             IteratePsfbREMBItem();
             break;
           case ParseState::State_XRItem:
@@ skipping 212 matching lines @@
 RTCPUtility::RTCPParserV2::IterateSLIItem()
 {
     const bool success = ParseSLIItem();
     if (!success)
     {
         Iterate();
     }
 }
 
 void
-RTCPUtility::RTCPParserV2::IterateRPSIItem()
-{
-    const bool success = ParseRPSIItem();
-    if (!success)
-    {
-        Iterate();
-    }
-}
-
-void
 RTCPUtility::RTCPParserV2::IterateFIRItem()
 {
     const bool success = ParseFIRItem();
     if (!success)
     {
         Iterate();
     }
 }
 
 void
@@ skipping 878 matching lines @@
         case 2:
             // SLI
           _packetType = RTCPPacketTypes::kPsfbSli;
             _packet.SLI.SenderSSRC = senderSSRC;
             _packet.SLI.MediaSSRC  = mediaSSRC;
 
             _state = ParseState::State_PSFB_SLIItem;
 
             return true;
         case 3:
-          _packetType = RTCPPacketTypes::kPsfbRpsi;
             _packet.RPSI.SenderSSRC = senderSSRC;
             _packet.RPSI.MediaSSRC  = mediaSSRC;
-
-            _state = ParseState::State_PSFB_RPSIItem;
+            if (!ParseRPSIItem()) {
+              _packetType = RTCPPacketTypes::kInvalid;
+              return false;
+            }
             return true;
         case 4:
             // FIR
           _packetType = RTCPPacketTypes::kPsfbFir;
             _packet.FIR.SenderSSRC = senderSSRC;
             _packet.FIR.MediaSSRC  = mediaSSRC;
 
             _state = ParseState::State_PSFB_FIRItem;
             return true;
         case 15:
@@ skipping 24 matching lines @@
     //  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     //  |      PB       |0| Payload Type|    Native RPSI bit string     |
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     //  |   defined per codec          ...                | Padding (0) |
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
     if (length < 4) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
     if (length > 2 + RTCP_RPSI_DATA_SIZE) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;

[åsapersson, 2016/04/11 09:22:55]

Should the packet type be set to kPsfbRpsiItem here?
(And remove changes above?)

[danilchap, 2016/04/11 11:00:31]

It is set to kPsfbRpsi in the very end of the function, after validating padding
size.
To Indicate parsing single item finish parsing packet, function renamed to
ParseRPSI.
Either way (valid and invalid) parser stay in the 'TopLevel' state and doesn't
need to enter/leave intermediate state.

-
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;
 
+    if (padding_bits > (length - 2) * 8) {
+        EndCurrentBlock();
+        return false;
+    }
     _packet.RPSI.NumberOfValidBits =
         static_cast<uint16_t>(length - 2) * 8 - padding_bits;
+    _packetType = RTCPPacketTypes::kPsfbRpsi;
     return true;
 }
 
 bool
 RTCPUtility::RTCPParserV2::ParseNACKItem()
 {
     // RFC 4585 6.2.1. Generic NACK
 
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
@@ skipping 346 matching lines @@
 const RTCPUtility::RtcpCommonHeader*
 RTCPUtility::RTCPPacketIterator::Current() {
     if (!_ptrBlock)
     {
         return NULL;
     }
 
     return &_header;
 }
 }  // namespace webrtc