Fixed rtcp rpsi parsing of invalid packets.

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

Index: webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
index 63693fa9c2289cfaf7bf229ec82ff8352225e87d..9b5a83515f4c54ddcd0e78d0ebff3ab7f9ca576f 100644
--- a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
@@ -1334,11 +1334,19 @@ bool RTCPUtility::RTCPParserV2::ParseRPSIItem() {
         return false;
     }
 
-    _packetType = RTCPPacketTypes::kPsfbRpsi;
 
     uint8_t padding_bits = *_ptrRTCPData++;
     _packet.RPSI.PayloadType = *_ptrRTCPData++;
 
+    if (padding_bits > static_cast<uint16_t>(length - 2) * 8) {
+      _state = ParseState::State_TopLevel;
+
+      EndCurrentBlock();
+      return false;
+    }
+
+    _packetType = RTCPPacketTypes::kPsfbRpsiItem;
+
     memcpy(_packet.RPSI.NativeBitString, _ptrRTCPData, length - 2);
     _ptrRTCPData += length - 2;