Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 1316 matching lines @@
         EndCurrentBlock();
         return false;
     }
     if (length > 2 + RTCP_RPSI_DATA_SIZE) {
       _state = ParseState::State_TopLevel;
 
         EndCurrentBlock();
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;
 
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
+    if (padding_bits > static_cast<uint16_t>(length - 2) * 8) {
+      _state = ParseState::State_TopLevel;
+
+      EndCurrentBlock();
+      return false;
+    }
+
+    _packetType = RTCPPacketTypes::kPsfbRpsiItem;
+
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;
 
     _packet.RPSI.NumberOfValidBits =
         static_cast<uint16_t>(length - 2) * 8 - padding_bits;
     return true;
 }
 
 bool
 RTCPUtility::RTCPParserV2::ParseNACKItem()
@@ skipping 351 matching lines @@
 const RTCPUtility::RtcpCommonHeader*
 RTCPUtility::RTCPPacketIterator::Current() {
     if (!_ptrBlock)
     {
         return NULL;
     }
 
     return &_header;
 }
 }  // namespace webrtc