Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

Index: webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
index 63693fa9c2289cfaf7bf229ec82ff8352225e87d..3151359b1ba367dbb2af6772243252c3eb77b771 100644
--- a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
@@ -130,9 +130,6 @@ RTCPUtility::RTCPParserV2::Iterate()
           case ParseState::State_PSFB_SLIItem:
             IterateSLIItem();
             break;
-          case ParseState::State_PSFB_RPSIItem:
-            IterateRPSIItem();
-            break;
           case ParseState::State_PSFB_FIRItem:
             IterateFIRItem();
             break;
@@ -365,16 +362,6 @@ RTCPUtility::RTCPParserV2::IterateSLIItem()
 }
 
 void
-RTCPUtility::RTCPParserV2::IterateRPSIItem()
-{
-    const bool success = ParseRPSIItem();
-    if (!success)
-    {
-        Iterate();
-    }
-}
-
-void
 RTCPUtility::RTCPParserV2::IterateFIRItem()
 {
     const bool success = ParseFIRItem();
@@ -1273,11 +1260,12 @@ bool RTCPUtility::RTCPParserV2::ParseFBCommon(const RtcpCommonHeader& header) {
 
             return true;
         case 3:
-          _packetType = RTCPPacketTypes::kPsfbRpsi;
             _packet.RPSI.SenderSSRC = senderSSRC;
             _packet.RPSI.MediaSSRC  = mediaSSRC;
-
-            _state = ParseState::State_PSFB_RPSIItem;
+            if (!ParseRPSIItem()) {
+              _packetType = RTCPPacketTypes::kInvalid;
+              return false;
+            }
             return true;
         case 4:
             // FIR
@@ -1322,28 +1310,27 @@ bool RTCPUtility::RTCPParserV2::ParseRPSIItem() {
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
     if (length < 4) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
     if (length > 2 + RTCP_RPSI_DATA_SIZE) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;

[åsapersson, 2016/04/11 09:22:55]

Should the packet type be set to kPsfbRpsiItem here?
(And remove changes above?)

[danilchap, 2016/04/11 11:00:31]

It is set to kPsfbRpsi in the very end of the function, after validating padding
size.
To Indicate parsing single item finish parsing packet, function renamed to
ParseRPSI.
Either way (valid and invalid) parser stay in the 'TopLevel' state and doesn't
need to enter/leave intermediate state.

-
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;
 
+    if (padding_bits > (length - 2) * 8) {
+        EndCurrentBlock();
+        return false;
+    }
     _packet.RPSI.NumberOfValidBits =
         static_cast<uint16_t>(length - 2) * 8 - padding_bits;
+    _packetType = RTCPPacketTypes::kPsfbRpsi;
     return true;
 }