Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 112 matching lines @@
             break;
           case ParseState::State_RTPFB_TMMBRItem:
             IterateTMMBRItem();
             break;
           case ParseState::State_RTPFB_TMMBNItem:
             IterateTMMBNItem();
             break;
           case ParseState::State_PSFB_SLIItem:
             IterateSLIItem();
             break;
-          case ParseState::State_PSFB_RPSIItem:
-            IterateRPSIItem();
-            break;
           case ParseState::State_PSFB_FIRItem:
             IterateFIRItem();
             break;
           case ParseState::State_PSFB_AppItem:
             IteratePsfbAppItem();
             break;
           case ParseState::State_PSFB_REMBItem:
             IteratePsfbREMBItem();
             break;
           case ParseState::State_XRItem:
@@ skipping 212 matching lines @@
 RTCPUtility::RTCPParserV2::IterateSLIItem()
 {
     const bool success = ParseSLIItem();
     if (!success)
     {
         Iterate();
     }
 }
 
 void
-RTCPUtility::RTCPParserV2::IterateRPSIItem()
-{
-    const bool success = ParseRPSIItem();
-    if (!success)
-    {
-        Iterate();
-    }
-}
-
-void
 RTCPUtility::RTCPParserV2::IterateFIRItem()
 {
     const bool success = ParseFIRItem();
     if (!success)
     {
         Iterate();
     }
 }
 
 void
@@ skipping 878 matching lines @@
         case 2:
             // SLI
           _packetType = RTCPPacketTypes::kPsfbSli;
             _packet.SLI.SenderSSRC = senderSSRC;
             _packet.SLI.MediaSSRC  = mediaSSRC;
 
             _state = ParseState::State_PSFB_SLIItem;
 
             return true;
         case 3:
-          _packetType = RTCPPacketTypes::kPsfbRpsi;
             _packet.RPSI.SenderSSRC = senderSSRC;
             _packet.RPSI.MediaSSRC  = mediaSSRC;
-
-            _state = ParseState::State_PSFB_RPSIItem;
+            if (!ParseRPSI()) {
+              _packetType = RTCPPacketTypes::kInvalid;
+              return false;
+            }
             return true;
         case 4:
             // FIR
           _packetType = RTCPPacketTypes::kPsfbFir;
             _packet.FIR.SenderSSRC = senderSSRC;
             _packet.FIR.MediaSSRC  = mediaSSRC;
 
             _state = ParseState::State_PSFB_FIRItem;
             return true;
         case 15:
           _packetType = RTCPPacketTypes::kPsfbApp;
             _packet.PSFBAPP.SenderSSRC = senderSSRC;
             _packet.PSFBAPP.MediaSSRC  = mediaSSRC;
 
             _state = ParseState::State_PSFB_AppItem;
             return true;
         default:
             break;
         }
 
         return false;
     }
     else
     {
       RTC_NOTREACHED();
         return false;
     }
 }
 
-bool RTCPUtility::RTCPParserV2::ParseRPSIItem() {
+bool RTCPUtility::RTCPParserV2::ParseRPSI() {
 
     // RFC 4585 6.3.3.  Reference Picture Selection Indication (RPSI).
     //
     //  0                   1                   2                   3
     //  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     //  |      PB       |0| Payload Type|    Native RPSI bit string     |
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     //  |   defined per codec          ...                | Padding (0) |
     //  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
     if (length < 4) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
     if (length > 2 + RTCP_RPSI_DATA_SIZE) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;
-
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;
 
+    if (padding_bits > (length - 2) * 8) {
+        EndCurrentBlock();
+        return false;
+    }
     _packet.RPSI.NumberOfValidBits =
         static_cast<uint16_t>(length - 2) * 8 - padding_bits;
+    _packetType = RTCPPacketTypes::kPsfbRpsi;
     return true;
 }
 
 bool
 RTCPUtility::RTCPParserV2::ParseNACKItem()
 {
     // RFC 4585 6.2.1. Generic NACK
 
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
@@ skipping 346 matching lines @@
 const RTCPUtility::RtcpCommonHeader*
 RTCPUtility::RTCPPacketIterator::Current() {
     if (!_ptrBlock)
     {
         return NULL;
     }
 
     return &_header;
 }
 }  // namespace webrtc