Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

Index: webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
index 63693fa9c2289cfaf7bf229ec82ff8352225e87d..9d44c4f8757575a5c9eed49a082bf4ef180c3af2 100644
--- a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
@@ -130,9 +130,6 @@ RTCPUtility::RTCPParserV2::Iterate()
           case ParseState::State_PSFB_SLIItem:
             IterateSLIItem();
             break;
-          case ParseState::State_PSFB_RPSIItem:
-            IterateRPSIItem();
-            break;
           case ParseState::State_PSFB_FIRItem:
             IterateFIRItem();
             break;
@@ -365,16 +362,6 @@ RTCPUtility::RTCPParserV2::IterateSLIItem()
 }
 
 void
-RTCPUtility::RTCPParserV2::IterateRPSIItem()
-{
-    const bool success = ParseRPSIItem();
-    if (!success)
-    {
-        Iterate();
-    }
-}
-
-void
 RTCPUtility::RTCPParserV2::IterateFIRItem()
 {
     const bool success = ParseFIRItem();
@@ -1273,11 +1260,12 @@ bool RTCPUtility::RTCPParserV2::ParseFBCommon(const RtcpCommonHeader& header) {
 
             return true;
         case 3:
-          _packetType = RTCPPacketTypes::kPsfbRpsi;
             _packet.RPSI.SenderSSRC = senderSSRC;
             _packet.RPSI.MediaSSRC  = mediaSSRC;
-
-            _state = ParseState::State_PSFB_RPSIItem;
+            if (!ParseRPSI()) {
+              _packetType = RTCPPacketTypes::kInvalid;
+              return false;
+            }
             return true;
         case 4:
             // FIR
@@ -1307,7 +1295,7 @@ bool RTCPUtility::RTCPParserV2::ParseFBCommon(const RtcpCommonHeader& header) {
     }
 }
 
-bool RTCPUtility::RTCPParserV2::ParseRPSIItem() {
+bool RTCPUtility::RTCPParserV2::ParseRPSI() {
 
     // RFC 4585 6.3.3.  Reference Picture Selection Indication (RPSI).
     //
@@ -1322,28 +1310,27 @@ bool RTCPUtility::RTCPParserV2::ParseRPSIItem() {
     const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
 
     if (length < 4) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
     if (length > 2 + RTCP_RPSI_DATA_SIZE) {
-      _state = ParseState::State_TopLevel;
-
         EndCurrentBlock();
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;
-
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;
 
+    if (padding_bits > (length - 2) * 8) {
+        EndCurrentBlock();
+        return false;
+    }
     _packet.RPSI.NumberOfValidBits =
         static_cast<uint16_t>(length - 2) * 8 - padding_bits;
+    _packetType = RTCPPacketTypes::kPsfbRpsi;
     return true;
 }