Fix buffer overflow parsing malformed rtp packet

webrtc/modules/rtp_rtcp/source/rtp_utility.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 305 matching lines @@
     const int id = (*ptr & 0xf0) >> 4;
     const int len = (*ptr & 0x0f);
     ptr++;
 
     if (id == 15) {
       LOG(LS_WARNING)
           << "RTP extension header 15 encountered. Terminate parsing.";
       return;
     }
 
+    if (ptrRTPDataExtensionEnd - ptr < (len+1)) {

[åsapersson, 2016/06/16 12:22:29]

check format here and below (len + 1)

[danilchap, 2016/06/16 12:54:22]

Done.

+      LOG(LS_WARNING) << "Incorrect one-byte extension len: " << (len+1)
+                      << ", bytes left in buffer: "
+                      << (ptrRTPDataExtensionEnd - ptr);

[åsapersson, 2016/06/16 12:22:29]

maybe also log the id

[danilchap, 2016/06/16 12:54:22]

For this kind of error id is not really interesting: extension block doesn't
follow one-byte extensions format.

+      return;
+    }
+
     RTPExtensionType type;
     if (ptrExtensionMap->GetType(id, &type) != 0) {
       // If we encounter an unknown extension, just skip over it.
       LOG(LS_WARNING) << "Failed to find extension id: " << id;
     } else {
       switch (type) {
         case kRtpExtensionTransmissionTimeOffset: {
           if (len != 2) {
             LOG(LS_WARNING) << "Incorrect transmission time offset len: "
                             << len;
@@ skipping 114 matching lines @@
     if (*ptr != 0) {
       return num_zero_bytes;
     }
     ptr++;
     num_zero_bytes++;
   }
   return num_zero_bytes;
 }
 }  // namespace RtpUtility
 }  // namespace webrtc