Fix off-by-one bugs in video_coding::PacketBuffer when the buffer is filled with a single frame.

webrtc/modules/video_coding/packet_buffer.cc

 /*
  *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 233 matching lines @@
     // If all packets of the frame is continuous, find the first packet of the
     // frame and create an RtpFrameObject.
     if (sequence_buffer_[index].frame_end) {
       size_t frame_size = 0;
       int max_nack_count = -1;
       uint16_t start_seq_num = seq_num;
 
       // Find the start index by searching backward until the packet with
       // the |frame_begin| flag is set.
       int start_index = index;
+      size_t tested_packets = 0;
 
       bool is_h264 = data_buffer_[start_index].codec == kVideoCodecH264;
       bool is_h264_keyframe = false;
       int64_t frame_timestamp = data_buffer_[start_index].timestamp;
 
-      // Since packet at |data_buffer_[index]| is already part of the frame
-      // we will have at most |size_ - 1| packets left to check.
-      for (size_t j = 0; j < size_ - 1; ++j) {
+      while (true) {
+        ++tested_packets;
         frame_size += data_buffer_[start_index].sizeBytes;
         max_nack_count =
             std::max(max_nack_count, data_buffer_[start_index].timesNacked);
         sequence_buffer_[start_index].frame_created = true;
 
         if (!is_h264 && sequence_buffer_[start_index].frame_begin)
           break;
 
         if (is_h264 && !is_h264_keyframe) {
           const RTPVideoHeaderH264& header =
               data_buffer_[start_index].video_header.codecHeader.H264;
           for (size_t i = 0; i < header.nalus_length; ++i) {
             if (header.nalus[i].type == H264::NaluType::kIdr) {
               is_h264_keyframe = true;
               break;
             }
           }
         }
 
+        if (tested_packets == size_)
+          break;
+
         start_index = start_index > 0 ? start_index - 1 : size_ - 1;
 
         // In the case of H264 we don't have a frame_begin bit (yes,
         // |frame_begin| might be set to true but that is a lie). So instead
         // we traverese backwards as long as we have a previous packet and
         // the timestamp of that packet is the same as this one. This may cause
         // the PacketBuffer to hand out incomplete frames.
         // See: https://bugs.chromium.org/p/webrtc/issues/detail?id=7106
         if (is_h264 &&
             (!sequence_buffer_[start_index].used ||
@@ skipping 47 matching lines @@
   }
 }
 
 bool PacketBuffer::GetBitstream(const RtpFrameObject& frame,
                                 uint8_t* destination) {
   rtc::CritScope lock(&crit_);
 
   size_t index = frame.first_seq_num() % size_;
   size_t end = (frame.last_seq_num() + 1) % size_;
   uint16_t seq_num = frame.first_seq_num();
-  while (index != end) {
+  uint8_t* destination_end = destination + frame.size();
+
+  do {
     if (!sequence_buffer_[index].used ||
         sequence_buffer_[index].seq_num != seq_num) {
       return false;
     }
 
+    RTC_DCHECK_EQ(data_buffer_[index].seqNum, sequence_buffer_[index].seq_num);
+    size_t length = data_buffer_[index].sizeBytes;
+    if (destination + length > destination_end) {
+      LOG(LS_WARNING) << "Frame (" << frame.picture_id << ":"
+                      << static_cast<int>(frame.spatial_layer) << ")"
+                      << " bitstream buffer is not large enough.";
+      return false;
+    }
+
     const uint8_t* source = data_buffer_[index].dataPtr;
-    size_t length = data_buffer_[index].sizeBytes;
     memcpy(destination, source, length);
     destination += length;
     index = (index + 1) % size_;
     ++seq_num;
-  }
+  } while (index != end);
+
   return true;
 }
 
 VCMPacket* PacketBuffer::GetPacket(uint16_t seq_num) {
   size_t index = seq_num % size_;
   if (!sequence_buffer_[index].used ||
       seq_num != sequence_buffer_[index].seq_num) {
     return nullptr;
   }
   return &data_buffer_[index];
@@ skipping 31 matching lines @@
       missing_packets_.insert(*newest_inserted_seq_num_);
       ++*newest_inserted_seq_num_;
     }
   } else {
     missing_packets_.erase(seq_num);
   }
 }
 
 }  // namespace video_coding
 }  // namespace webrtc