Fix buffer overflow parsing malformed rtp packet

webrtc/modules/rtp_rtcp/source/rtp_utility.cc

Index: webrtc/modules/rtp_rtcp/source/rtp_utility.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtp_utility.cc b/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
index 131b54ad50ee47f4bf9bded80dbc3aba864200d5..a6f08098e1418278220407b89005a4bd81fba6e8 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
@@ -323,6 +323,13 @@ void RtpHeaderParser::ParseOneByteExtensionHeader(
       return;
     }
 
+    if (ptrRTPDataExtensionEnd - ptr < (len+1)) {

[åsapersson, 2016/06/16 12:22:29]

check format here and below (len + 1)

[danilchap, 2016/06/16 12:54:22]

Done.

+      LOG(LS_WARNING) << "Incorrect one-byte extension len: " << (len+1)
+                      << ", bytes left in buffer: "
+                      << (ptrRTPDataExtensionEnd - ptr);

[åsapersson, 2016/06/16 12:22:29]

maybe also log the id

[danilchap, 2016/06/16 12:54:22]

For this kind of error id is not really interesting: extension block doesn't
follow one-byte extensions format.

+      return;
+    }
+
     RTPExtensionType type;
     if (ptrExtensionMap->GetType(id, &type) != 0) {
       // If we encounter an unknown extension, just skip over it.