Before validating a STUN packet, check it's big enough for a header.

webrtc/p2p/base/stun.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 114 matching lines @@
 const StunUInt16ListAttribute* StunMessage::GetUnknownAttributes() const {
   return static_cast<const StunUInt16ListAttribute*>(
       GetAttribute(STUN_ATTR_UNKNOWN_ATTRIBUTES));
 }
 
 // Verifies a STUN message has a valid MESSAGE-INTEGRITY attribute, using the
 // procedure outlined in RFC 5389, section 15.4.
 bool StunMessage::ValidateMessageIntegrity(const char* data, size_t size,
                                            const std::string& password) {
   // Verifying the size of the message.
-  if ((size % 4) != 0) {
+  if ((size % 4) != 0 || size < kStunHeaderSize) {
     return false;
   }
 
   // Getting the message length from the STUN header.
   uint16_t msg_length = rtc::GetBE16(&data[2]);
   if (size != (msg_length + kStunHeaderSize)) {
     return false;
   }
 
   // Finding Message Integrity attribute in stun message.
@@ skipping 765 matching lines @@
       digest, sizeof(digest));
   if (size == 0) {
     return false;
   }
 
   *hash = std::string(digest, size);
   return true;
 }
 
 }  // namespace cricket