generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixing a bug in DummyRTPpacket

Browse Source 
This bug caused writing outside allocated memory when RTP header
extensions were used.

BUG=2834
TBR=turaj@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/8009005

git-svn-id: http://webrtc.googlecode.com/svn/trunk@5489 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
henrik.lundin@webrtc.org
2014-02-05 08:46:46 +00:00
parent 54744918ef
commit e6ab21b9ca
3 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_DummyRTPpacket.cc
View File

@@ -60,17 +60,18 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
length = (uint16_t) (length - _kRDHeaderLen); length = (uint16_t) (length - _kRDHeaderLen);
// check buffer size // check buffer size
if (_datagram && _memSize < length) if (_datagram && _memSize < length + 1)
{ {
reset(); reset();
} }
if (!_datagram) if (!_datagram)
{ {
_datagram = new uint8_t[length]; // Add one extra byte, to be able to fake a dummy payload of 1 byte.
_memSize = length; _datagram = new uint8_t[length + 1];
_memSize = length + 1;
} }
memset(_datagram, 0, length); memset(_datagram, 0, length + 1);
if (length == 0) if (length == 0)
{ {
@@ -102,8 +103,7 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
// Read extension from file // Read extension from file
size_t readLen = newLen - _kBasicHeaderLen; size_t readLen = newLen - _kBasicHeaderLen;
if (fread((unsigned short *) _datagram + _kBasicHeaderLen, 1, if (fread(&_datagram[_kBasicHeaderLen], 1, readLen, fp) != readLen)
readLen, fp) != readLen)
{ {
reset(); reset();
return -1; return -1;
@@ -117,8 +117,7 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
// Read extension from file // Read extension from file
size_t readLen = totHdrLen - newLen; size_t readLen = totHdrLen - newLen;
if (fread((unsigned short *) _datagram + newLen, 1, readLen, fp) if (fread(&_datagram[newLen], 1, readLen, fp) != readLen)
!= readLen)
{ {
reset(); reset();
return -1; return -1;
@@ -135,6 +134,8 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
} }
_rtpParsed = false; _rtpParsed = false;
assert(_memSize > _datagramLen);
_payloadLen = 1; // Set the length to 1 byte.
return packetLen; return packetLen;
} }
@@ -195,3 +196,9 @@ int NETEQTEST_DummyRTPpacket::writeToFile(FILE *fp)
} }
void NETEQTEST_DummyRTPpacket::parseHeader() {
NETEQTEST_RTPpacket::parseHeader();
// Change _payloadLen to 1 byte. The memory should always be big enough.
assert(_memSize > _datagramLen);
_payloadLen = 1;
}

1
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_DummyRTPpacket.h
View File

@@ -17,6 +17,7 @@ class NETEQTEST_DummyRTPpacket : public NETEQTEST_RTPpacket {
public: public:
virtual int readFromFile(FILE* fp) OVERRIDE; virtual int readFromFile(FILE* fp) OVERRIDE;
virtual int writeToFile(FILE* fp) OVERRIDE; virtual int writeToFile(FILE* fp) OVERRIDE;
virtual void parseHeader() OVERRIDE;
}; };
#endif // NETEQTEST_DUMMYRTPPACKET_H #endif // NETEQTEST_DUMMYRTPPACKET_H

2
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_RTPpacket.h
View File

@@ -37,7 +37,7 @@ public:
virtual int writeToFile(FILE *fp); virtual int writeToFile(FILE *fp);
void blockPT(uint8_t pt); void blockPT(uint8_t pt);
//int16_t payloadType(); //int16_t payloadType();
void parseHeader(); virtual void parseHeader();
void parseHeader(webrtc::WebRtcRTPHeader* rtp_header); void parseHeader(webrtc::WebRtcRTPHeader* rtp_header);
const webrtc::WebRtcRTPHeader* RTPinfo() const; const webrtc::WebRtcRTPHeader* RTPinfo() const;
uint8_t * datagram() const; uint8_t * datagram() const;