Fix oversized rtp header extension parsing.

webrtc/modules/rtp_rtcp/source/rtp_packet.cc

 /*
  *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "webrtc/modules/rtp_rtcp/source/rtp_packet.h"
 
 #include <cstring>
+#include <utility>
 
 #include "webrtc/base/checks.h"
 #include "webrtc/base/logging.h"
 #include "webrtc/base/random.h"
 #include "webrtc/common_types.h"
 #include "webrtc/modules/rtp_rtcp/source/rtp_header_extension.h"
 #include "webrtc/modules/rtp_rtcp/source/rtp_header_extensions.h"
 #include "webrtc/modules/rtp_rtcp/source/byte_io.h"
 
 namespace webrtc {
@@ skipping 366 matching lines @@
       while (extensions_size_ + kOneByteHeaderSize < extensions_capacity) {
         uint8_t id = buffer[extension_offset + extensions_size_] >> 4;
         if (id == kReservedId) {
           break;
         } else if (id == kPaddingId) {
           extensions_size_++;
           continue;
         }
         uint8_t length =
             1 + (buffer[extension_offset + extensions_size_] & 0xf);
+        if (extensions_size_ + kOneByteHeaderSize + length >
+            extensions_capacity) {
+          LOG(LS_WARNING) << "Oversized rtp header extension.";
+          break;
+        }
+        if (num_extensions_ >= kMaxExtensionHeaders) {
+          LOG(LS_WARNING) << "Too many rtp header extensions.";
+          break;
+        }
         extensions_size_ += kOneByteHeaderSize;
-        if (num_extensions_ >= kMaxExtensionHeaders) {
-          LOG(LS_WARNING) << "Too many extensions.";
-          return false;
-        }
         extension_entries_[num_extensions_].type =
             extensions_ ? extensions_->GetType(id)
                         : ExtensionManager::kInvalidType;
         extension_entries_[num_extensions_].length = length;
         extension_entries_[num_extensions_].offset =
             extension_offset + extensions_size_;
         num_extensions_++;
         extensions_size_ += length;
       }
     }
@@ skipping 101 matching lines @@
 uint8_t* Packet::WriteAt(size_t offset) {
   return buffer_.data() + offset;
 }
 
 void Packet::WriteAt(size_t offset, uint8_t byte) {
   buffer_.data()[offset] = byte;
 }
 
 }  // namespace rtp
 }  // namespace webrtc