generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent depacketizer OOB reads on zero-length VP8 payload.

Browse Source 
BUG=webrtc:4771
R=stefan@webrtc.org

Review URL: https://codereview.webrtc.org/1221643009

Cr-Commit-Position: refs/heads/master@{#9520}
This commit is contained in:
pbos 2015-06-30 02:12:03 -07:00 committed by Commit bot
parent 6e355af348
commit 48c3839e70
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
webrtc/modules/rtp_rtcp/source/rtp_format_vp8.cc
View File

@ -668,6 +668,10 @@ bool RtpDepacketizerVp8::Parse(ParsedPayload* parsed_payload,
const uint8_t* payload_data, const uint8_t* payload_data,
size_t payload_data_length) { size_t payload_data_length) {
assert(parsed_payload != NULL); assert(parsed_payload != NULL);
if (payload_data_length == 0) {
LOG(LS_ERROR) << "Empty payload.";
return false;
}
// Parse mandatory first byte of payload descriptor. // Parse mandatory first byte of payload descriptor.
bool extension = (*payload_data & 0x80) ? true : false; // X bit bool extension = (*payload_data & 0x80) ? true : false; // X bit

7
webrtc/modules/rtp_rtcp/source/rtp_format_vp8_unittest.cc
View File

@ -596,4 +596,11 @@ TEST_F(RtpDepacketizerVp8Test, TestWithPacketizer) {
EXPECT_EQ(payload.type.Video.codecHeader.VP8.layerSync, EXPECT_EQ(payload.type.Video.codecHeader.VP8.layerSync,
input_header.layerSync); input_header.layerSync);
} }
TEST_F(RtpDepacketizerVp8Test, TestEmptyPayload) {
// Using a wild pointer to crash on accesses from inside the depacketizer.
uint8_t* garbage_ptr = reinterpret_cast<uint8_t*>(0x4711);
RtpDepacketizer::ParsedPayload payload;
EXPECT_FALSE(depacketizer_->Parse(&payload, garbage_ptr, 0));
}
} // namespace webrtc } // namespace webrtc