Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(11)

Side by Side Diff: webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

Issue 1888793003: Fixed undefined shift in parsing Tmmbr, Tmmbn and Remb (Closed) Base URL: https://chromium.googlesource.com/external/webrtc.git@master
Patch Set: Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (c) 2012 The WebRTC project authors. All Rights Reserved. 2 * Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license 4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source 5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found 6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may 7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree. 8 * be found in the AUTHORS file in the root of the source tree.
9 */ 9 */
10 10
11 #include "webrtc/modules/rtp_rtcp/source/rtcp_utility.h" 11 #include "webrtc/modules/rtp_rtcp/source/rtcp_utility.h"
12 12
13 #include <assert.h> 13 #include <assert.h>
14 #include <math.h> // ceil 14 #include <math.h> // ceil
15 #include <string.h> // memcpy 15 #include <string.h> // memcpy
16 16
17 #include <limits>
18
17 #include "webrtc/base/checks.h" 19 #include "webrtc/base/checks.h"
18 #include "webrtc/base/logging.h" 20 #include "webrtc/base/logging.h"
19 #include "webrtc/modules/rtp_rtcp/source/byte_io.h" 21 #include "webrtc/modules/rtp_rtcp/source/byte_io.h"
20 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.h" 22 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.h"
21 23
22 namespace webrtc { 24 namespace webrtc {
25 namespace {
26 constexpr uint64_t kMaxBitrateBps = std::numeric_limits<uint32_t>::max();
27 } // namespace
23 28
24 namespace RTCPUtility { 29 namespace RTCPUtility {
25 30
26 NackStats::NackStats() 31 NackStats::NackStats()
27 : max_sequence_number_(0), 32 : max_sequence_number_(0),
28 requests_(0), 33 requests_(0),
29 unique_requests_(0) {} 34 unique_requests_(0) {}
30 35
31 NackStats::~NackStats() {} 36 NackStats::~NackStats() {}
32 37
(...skipping 1400 matching lines...) Expand 10 before | Expand all | Expand 10 after
1433 1438
1434 if (length < 4) 1439 if (length < 4)
1435 { 1440 {
1436 _state = ParseState::State_TopLevel; 1441 _state = ParseState::State_TopLevel;
1437 1442
1438 EndCurrentBlock(); 1443 EndCurrentBlock();
1439 return false; 1444 return false;
1440 } 1445 }
1441 1446
1442 _packet.REMBItem.NumberOfSSRCs = *_ptrRTCPData++; 1447 _packet.REMBItem.NumberOfSSRCs = *_ptrRTCPData++;
1443 const uint8_t brExp = (_ptrRTCPData[0] >> 2) & 0x3F; 1448 const uint8_t exp = (_ptrRTCPData[0] >> 2) & 0x3F;
1444 1449
1445 uint32_t brMantissa = (_ptrRTCPData[0] & 0x03) << 16; 1450 uint64_t mantissa = (_ptrRTCPData[0] & 0x03) << 16;
1446 brMantissa += (_ptrRTCPData[1] << 8); 1451 mantissa += (_ptrRTCPData[1] << 8);
1447 brMantissa += (_ptrRTCPData[2]); 1452 mantissa += (_ptrRTCPData[2]);
1448 1453
1449 _ptrRTCPData += 3; // Fwd read data 1454 _ptrRTCPData += 3; // Fwd read data
1450 _packet.REMBItem.BitRate = (brMantissa << brExp); 1455 uint64_t bitrate_bps = (mantissa << exp);
1456 bool shift_overflow = exp > 0 && (mantissa >> (64 - exp)) != 0;
1457 if (shift_overflow || bitrate_bps > kMaxBitrateBps) {
1458 LOG(LS_ERROR) << "Invalid remb bitrate value : " << mantissa
åsapersson 2016/04/18 13:34:15 maybe invalid -> unhandled (here and below)
danilchap 2016/04/18 19:08:15 Done.
1459 << "*2^" << static_cast<int>(exp);
1460 _state = ParseState::State_TopLevel;
1461 EndCurrentBlock();
1462 return false;
1463 }
1464 _packet.REMBItem.BitRate = bitrate_bps;
1451 1465
åsapersson 2016/04/18 13:34:15 Add test (rtcp_receiver_test.cc) which inserts a R
danilchap 2016/04/18 19:08:15 There was a hidden test (HandlesInvalidTransportFe
1452 const ptrdiff_t length_ssrcs = _ptrRTCPBlockEnd - _ptrRTCPData; 1466 const ptrdiff_t length_ssrcs = _ptrRTCPBlockEnd - _ptrRTCPData;
1453 if (length_ssrcs < 4 * _packet.REMBItem.NumberOfSSRCs) 1467 if (length_ssrcs < 4 * _packet.REMBItem.NumberOfSSRCs)
1454 { 1468 {
1455 _state = ParseState::State_TopLevel; 1469 _state = ParseState::State_TopLevel;
1456 1470
1457 EndCurrentBlock(); 1471 EndCurrentBlock();
1458 return false; 1472 return false;
1459 } 1473 }
1460 1474
1461 _packetType = RTCPPacketTypes::kPsfbRembItem; 1475 _packetType = RTCPPacketTypes::kPsfbRembItem;
(...skipping 23 matching lines...) Expand all
1485 return false; 1499 return false;
1486 } 1500 }
1487 1501
1488 _packetType = RTCPPacketTypes::kRtpfbTmmbrItem; 1502 _packetType = RTCPPacketTypes::kRtpfbTmmbrItem;
1489 1503
1490 _packet.TMMBRItem.SSRC = *_ptrRTCPData++ << 24; 1504 _packet.TMMBRItem.SSRC = *_ptrRTCPData++ << 24;
1491 _packet.TMMBRItem.SSRC += *_ptrRTCPData++ << 16; 1505 _packet.TMMBRItem.SSRC += *_ptrRTCPData++ << 16;
1492 _packet.TMMBRItem.SSRC += *_ptrRTCPData++ << 8; 1506 _packet.TMMBRItem.SSRC += *_ptrRTCPData++ << 8;
1493 _packet.TMMBRItem.SSRC += *_ptrRTCPData++; 1507 _packet.TMMBRItem.SSRC += *_ptrRTCPData++;
1494 1508
1495 uint8_t mxtbrExp = (_ptrRTCPData[0] >> 2) & 0x3F; 1509 uint8_t exp = (_ptrRTCPData[0] >> 2) & 0x3F;
1496 1510
1497 uint32_t mxtbrMantissa = (_ptrRTCPData[0] & 0x03) << 15; 1511 uint64_t mantissa = (_ptrRTCPData[0] & 0x03) << 15;
1498 mxtbrMantissa += (_ptrRTCPData[1] << 7); 1512 mantissa += (_ptrRTCPData[1] << 7);
1499 mxtbrMantissa += (_ptrRTCPData[2] >> 1) & 0x7F; 1513 mantissa += (_ptrRTCPData[2] >> 1) & 0x7F;
1500 1514
1501 uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8; 1515 uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8;
1502 measuredOH += _ptrRTCPData[3]; 1516 measuredOH += _ptrRTCPData[3];
1503 1517
1504 _ptrRTCPData += 4; // Fwd read data 1518 _ptrRTCPData += 4; // Fwd read data
1505 1519
1506 _packet.TMMBRItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000 ); 1520 uint64_t bitrate_bps = (mantissa << exp);
1521 bool shift_overflow = exp > 0 && (mantissa >> (64 - exp)) != 0;
1522 if (shift_overflow || bitrate_bps > kMaxBitrateBps) {
1523 LOG(LS_ERROR) << "Invalid remb bitrate value : " << mantissa
åsapersson 2016/04/18 13:34:15 remb -> tmmbr
danilchap 2016/04/18 19:08:14 Oops, done.
1524 << "*2^" << static_cast<int>(exp);
1525 _state = ParseState::State_TopLevel;
1526 EndCurrentBlock();
1527 return false;
1528 }
1529
1530 _packet.TMMBRItem.MaxTotalMediaBitRate = bitrate_bps / 1000;
1507 _packet.TMMBRItem.MeasuredOverhead = measuredOH; 1531 _packet.TMMBRItem.MeasuredOverhead = measuredOH;
1508 1532
1509 return true; 1533 return true;
1510 } 1534 }
1511 1535
1512 bool 1536 bool
1513 RTCPUtility::RTCPParserV2::ParseTMMBNItem() 1537 RTCPUtility::RTCPParserV2::ParseTMMBNItem()
1514 { 1538 {
1515 // RFC 5104 4.2.2. Temporary Maximum Media Stream Bit Rate Notification (TMM BN) 1539 // RFC 5104 4.2.2. Temporary Maximum Media Stream Bit Rate Notification (TMM BN)
1516 1540
1517 const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData; 1541 const ptrdiff_t length = _ptrRTCPBlockEnd - _ptrRTCPData;
1518 1542
1519 if (length < 8) 1543 if (length < 8)
1520 { 1544 {
1521 _state = ParseState::State_TopLevel; 1545 _state = ParseState::State_TopLevel;
1522 1546
1523 EndCurrentBlock(); 1547 EndCurrentBlock();
1524 return false; 1548 return false;
1525 } 1549 }
1526 1550
1527 _packetType = RTCPPacketTypes::kRtpfbTmmbnItem; 1551 _packetType = RTCPPacketTypes::kRtpfbTmmbnItem;
1528 1552
1529 _packet.TMMBNItem.SSRC = *_ptrRTCPData++ << 24; 1553 _packet.TMMBNItem.SSRC = *_ptrRTCPData++ << 24;
1530 _packet.TMMBNItem.SSRC += *_ptrRTCPData++ << 16; 1554 _packet.TMMBNItem.SSRC += *_ptrRTCPData++ << 16;
1531 _packet.TMMBNItem.SSRC += *_ptrRTCPData++ << 8; 1555 _packet.TMMBNItem.SSRC += *_ptrRTCPData++ << 8;
1532 _packet.TMMBNItem.SSRC += *_ptrRTCPData++; 1556 _packet.TMMBNItem.SSRC += *_ptrRTCPData++;
1533 1557
1534 uint8_t mxtbrExp = (_ptrRTCPData[0] >> 2) & 0x3F; 1558 uint8_t exp = (_ptrRTCPData[0] >> 2) & 0x3F;
1535 1559
1536 uint32_t mxtbrMantissa = (_ptrRTCPData[0] & 0x03) << 15; 1560 uint64_t mantissa = (_ptrRTCPData[0] & 0x03) << 15;
1537 mxtbrMantissa += (_ptrRTCPData[1] << 7); 1561 mantissa += (_ptrRTCPData[1] << 7);
1538 mxtbrMantissa += (_ptrRTCPData[2] >> 1) & 0x7F; 1562 mantissa += (_ptrRTCPData[2] >> 1) & 0x7F;
1539 1563
1540 uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8; 1564 uint32_t measuredOH = (_ptrRTCPData[2] & 0x01) << 8;
1541 measuredOH += _ptrRTCPData[3]; 1565 measuredOH += _ptrRTCPData[3];
1542 1566
1543 _ptrRTCPData += 4; // Fwd read data 1567 _ptrRTCPData += 4; // Fwd read data
1544 1568
1545 _packet.TMMBNItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000 ); 1569 uint64_t bitrate_bps = (mantissa << exp);
1570 bool shift_overflow = exp > 0 && (mantissa >> (64 - exp)) != 0;
1571 if (shift_overflow || bitrate_bps > kMaxBitrateBps) {
1572 LOG(LS_ERROR) << "Invalid tmmbn bitrate value : " << mantissa
1573 << "*2^" << static_cast<int>(exp);
1574 _state = ParseState::State_TopLevel;
1575 EndCurrentBlock();
1576 return false;
1577 }
1578
1579 _packet.TMMBNItem.MaxTotalMediaBitRate = bitrate_bps / 1000;
1546 _packet.TMMBNItem.MeasuredOverhead = measuredOH; 1580 _packet.TMMBNItem.MeasuredOverhead = measuredOH;
1547 1581
1548 return true; 1582 return true;
1549 } 1583 }
1550 1584
1551 bool 1585 bool
1552 RTCPUtility::RTCPParserV2::ParseSLIItem() 1586 RTCPUtility::RTCPParserV2::ParseSLIItem()
1553 { 1587 {
1554 // RFC 5104 6.3.2. Slice Loss Indication (SLI) 1588 // RFC 5104 6.3.2. Slice Loss Indication (SLI)
1555 /* 1589 /*
(...skipping 155 matching lines...) Expand 10 before | Expand all | Expand 10 after
1711 const RTCPUtility::RtcpCommonHeader* 1745 const RTCPUtility::RtcpCommonHeader*
1712 RTCPUtility::RTCPPacketIterator::Current() { 1746 RTCPUtility::RTCPPacketIterator::Current() {
1713 if (!_ptrBlock) 1747 if (!_ptrBlock)
1714 { 1748 {
1715 return NULL; 1749 return NULL;
1716 } 1750 }
1717 1751
1718 return &_header; 1752 return &_header;
1719 } 1753 }
1720 } // namespace webrtc 1754 } // namespace webrtc
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698