Reject XR TargetBitrate items with unsupported layer indices

webrtc/modules/rtp_rtcp/source/rtcp_receiver.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "webrtc/modules/rtp_rtcp/source/rtcp_receiver.h"
 
 #include <assert.h>
 #include <string.h>
 
 #include <limits>
 #include <map>
 #include <memory>
 #include <utility>
 #include <vector>
 
 #include "webrtc/base/checks.h"
 #include "webrtc/base/logging.h"
 #include "webrtc/base/trace_event.h"
+#include "webrtc/common_types.h"
 #include "webrtc/common_video/include/video_bitrate_allocator.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/bye.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/common_header.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/compound_packet.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/extended_reports.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/fir.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/nack.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/pli.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/rapid_resync_request.h"
 #include "webrtc/modules/rtp_rtcp/source/rtcp_packet/receiver_report.h"
@@ skipping 695 matching lines @@
 
   uint32_t rtt_ntp = now - delay_rr - send_time;
   xr_rr_rtt_ms_ = CompactNtpRttToMs(rtt_ntp);
 }
 
 void RTCPReceiver::HandleXrTargetBitrate(
     const rtcp::TargetBitrate& target_bitrate,
     PacketInformation* packet_information) {
   BitrateAllocation bitrate_allocation;
   for (const auto& item : target_bitrate.GetTargetBitrates()) {
-    bitrate_allocation.SetBitrate(item.spatial_layer, item.temporal_layer,
-                                  item.target_bitrate_kbps * 1000);
+    if (item.spatial_layer >= kMaxSpatialLayers ||
+        item.temporal_layer >= kMaxTemporalStreams) {
+      LOG(LS_WARNING)
+          << "Invalid layer in XR target bitrate pack: spatial index "
+          << item.spatial_layer << ", temporal index " << item.temporal_layer
+          << ", dropping.";
+    } else {
+      bitrate_allocation.SetBitrate(item.spatial_layer, item.temporal_layer,
+                                    item.target_bitrate_kbps * 1000);
+    }
   }
   packet_information->target_bitrate_allocation.emplace(bitrate_allocation);
 }
 
 void RTCPReceiver::HandlePLI(const CommonHeader& rtcp_block,
                              PacketInformation* packet_information) {
   rtcp::Pli pli;
   if (!pli.Parse(rtcp_block)) {
     ++num_skipped_packets_;
     return;
@@ skipping 323 matching lines @@
       } else {
         candidates.push_back(it->second.tmmbr_item);
         ++it;
       }
     }
   }
   return candidates;
 }
 
 }  // namespace webrtc