Fixed undefined shift in parsing Tmmbr, Tmmbn and Remb

webrtc/modules/rtp_rtcp/source/rtcp_utility.cc

Index: webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
index 9b5a83515f4c54ddcd0e78d0ebff3ab7f9ca576f..424a9df7d4dfd54fc63c07f700949abeb37ee1bf 100644
--- a/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtcp_utility.cc
@@ -1447,6 +1447,11 @@ RTCPUtility::RTCPParserV2::ParsePsfbREMBItem()
     brMantissa += (_ptrRTCPData[2]);
 
     _ptrRTCPData += 3; // Fwd read data
+    if (brExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
     _packet.REMBItem.BitRate = (brMantissa << brExp);

[åsapersson, 2016/04/18 09:51:47]

Might give an incorrect bitrate if brExp > 14, right?

[danilchap, 2016/04/18 10:41:42]

Yes, it can. Updated code to be stricter about unsupported (too large) bitrate.

 
     const ptrdiff_t length_ssrcs = _ptrRTCPBlockEnd - _ptrRTCPData;
@@ -1503,6 +1508,12 @@ RTCPUtility::RTCPParserV2::ParseTMMBRItem()
 
     _ptrRTCPData += 4; // Fwd read data
 
+    if (mxtbrExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
+
     _packet.TMMBRItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000);
     _packet.TMMBRItem.MeasuredOverhead     = measuredOH;
 
@@ -1542,6 +1553,12 @@ RTCPUtility::RTCPParserV2::ParseTMMBNItem()
 
     _ptrRTCPData += 4; // Fwd read data
 
+    if (mxtbrExp >= 32) {
+      _state = ParseState::State_TopLevel;
+      EndCurrentBlock();
+      return false;
+    }
+
     _packet.TMMBNItem.MaxTotalMediaBitRate = ((mxtbrMantissa << mxtbrExp) / 1000);
     _packet.TMMBNItem.MeasuredOverhead     = measuredOH;