Fix buffer overflow in HMAC validation of STUN messages.

webrtc/p2p/base/stun.cc

Index: webrtc/p2p/base/stun.cc
diff --git a/webrtc/p2p/base/stun.cc b/webrtc/p2p/base/stun.cc
index 180597ee77c11a46e52d379cf1c2fe5d7450291f..9878921a6072f018f1117becf5e7334078e01aca 100644
--- a/webrtc/p2p/base/stun.cc
+++ b/webrtc/p2p/base/stun.cc
@@ -154,7 +154,7 @@ bool StunMessage::ValidateMessageIntegrity(const char* data, size_t size,
     // If M-I, sanity check it, and break out.
     if (attr_type == STUN_ATTR_MESSAGE_INTEGRITY) {
       if (attr_length != kStunMessageIntegritySize ||
-          current_pos + attr_length > size) {
+          current_pos + attr_length >= size) {

[Sergey Ulanov, 2016/06/17 00:52:49]

Should this be "current_pos + sizeof(attr_type) + sizeof(attr_length) +
attr_lenght > size"?

[katrielc1, 2016/06/17 08:21:55]

Yes, you're right.

(I think it may be equivalent since current_pos is rounded to the nearest 4
later, but this is the right thing to check.)

         return false;
       }
       has_message_integrity_attr = true;