Fixed undefined shift in parsing Tmmbr, Tmmbn and Remb

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 1429 matching lines @@
     }
 
     _packet.REMBItem.NumberOfSSRCs = *_ptrRTCPData++;
     const uint8_t brExp = (_ptrRTCPData[0] >> 2) & 0x3F;
 
     uint32_t brMantissa = (_ptrRTCPData[0] & 0x03) << 16;
     brMantissa += (_ptrRTCPData[1] << 8);
     brMantissa += (_ptrRTCPData[2]);
 
     _ptrRTCPData += 3; // Fwd read data
+    if (brExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
     _packet.REMBItem.BitRate = (brMantissa << brExp);

[åsapersson, 2016/04/18 09:51:47]

Might give an incorrect bitrate if brExp > 14, right?

[danilchap, 2016/04/18 10:41:42]

Yes, it can. Updated code to be stricter about unsupported (too large) bitrate.

 
     const ptrdiff_t length_ssrcs = _ptrRTCPBlockEnd - _ptrRTCPData;
     if (length_ssrcs < 4 * _packet.REMBItem.NumberOfSSRCs)
     {
       _state = ParseState::State_TopLevel;
 
         EndCurrentBlock();
         return false;
     }
 
@@ skipping 35 matching lines @@
 
     uint32_t mxtbrMantissa = (_ptrRTCPData[0] & 0x03) << 15;
     mxtbrMantissa += (_ptrRTCPData[1] << 7);
     mxtbrMantissa += (_ptrRTCPData[2] >> 1) & 0x7F;
 
     uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8;
     measuredOH += _ptrRTCPData[3];
 
     _ptrRTCPData += 4; // Fwd read data
 
+    if (mxtbrExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
+
     _packet.TMMBRItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000);
     _packet.TMMBRItem.MeasuredOverhead     = measuredOH;
 
     return true;
 }
 
 bool
 RTCPUtility::RTCPParserV2::ParseTMMBNItem()
 {
     // RFC 5104 4.2.2. Temporary Maximum Media Stream Bit Rate Notification (TMMBN)
@@ skipping 19 matching lines @@
 
     uint32_t mxtbrMantissa = (_ptrRTCPData[0] & 0x03) << 15;
     mxtbrMantissa += (_ptrRTCPData[1] << 7);
     mxtbrMantissa += (_ptrRTCPData[2] >> 1) & 0x7F;
 
     uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8;
     measuredOH += _ptrRTCPData[3];
 
     _ptrRTCPData += 4; // Fwd read data
 
+    if (mxtbrExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
+
     _packet.TMMBNItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000);
     _packet.TMMBNItem.MeasuredOverhead     = measuredOH;
 
     return true;
 }
 
 bool
 RTCPUtility::RTCPParserV2::ParseSLIItem()
 {
     // RFC 5104 6.3.2.  Slice Loss Indication (SLI)
@@ skipping 156 matching lines @@
 const RTCPUtility::RtcpCommonHeader*
 RTCPUtility::RTCPPacketIterator::Current() {
     if (!_ptrBlock)
     {
         return NULL;
     }
 
     return &_header;
 }
 }  // namespace webrtc