generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixing a bug in DummyRTPpacket

Browse Source 
This bug caused writing outside allocated memory when RTP header
extensions were used.

BUG=2834
TBR=turaj@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/8009005

git-svn-id: http://webrtc.googlecode.com/svn/trunk@5489 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
henrik.lundin@webrtc.org
2014-02-05 08:46:46 +00:00
parent 54744918ef
commit e6ab21b9ca
3 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_DummyRTPpacket.cc
View File

@@ -60,17 +60,18 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
length = (uint16_t) (length - _kRDHeaderLen);
// check buffer size
if (_datagram && _memSize < length)
if (_datagram && _memSize < length + 1)
{
reset();
}
if (!_datagram)
{
_datagram = new uint8_t[length];
_memSize = length;
// Add one extra byte, to be able to fake a dummy payload of 1 byte.
_datagram = new uint8_t[length + 1];
_memSize = length + 1;
}
memset(_datagram, 0, length);
memset(_datagram, 0, length + 1);
if (length == 0)
{
@@ -102,8 +103,7 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
// Read extension from file
size_t readLen = newLen - _kBasicHeaderLen;
if (fread((unsigned short *) _datagram + _kBasicHeaderLen, 1,
readLen, fp) != readLen)
if (fread(&_datagram[_kBasicHeaderLen], 1, readLen, fp) != readLen)
{
reset();
return -1;
@@ -117,8 +117,7 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
// Read extension from file
size_t readLen = totHdrLen - newLen;
if (fread((unsigned short *) _datagram + newLen, 1, readLen, fp)
!= readLen)
if (fread(&_datagram[newLen], 1, readLen, fp) != readLen)
{
reset();
return -1;
@@ -135,6 +134,8 @@ int NETEQTEST_DummyRTPpacket::readFromFile(FILE *fp)
}
_rtpParsed = false;
assert(_memSize > _datagramLen);
_payloadLen = 1; // Set the length to 1 byte.
return packetLen;
}
@@ -195,3 +196,9 @@ int NETEQTEST_DummyRTPpacket::writeToFile(FILE *fp)
}
void NETEQTEST_DummyRTPpacket::parseHeader() {
NETEQTEST_RTPpacket::parseHeader();
// Change _payloadLen to 1 byte. The memory should always be big enough.
assert(_memSize > _datagramLen);
_payloadLen = 1;
}

1
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_DummyRTPpacket.h
View File

@@ -17,6 +17,7 @@ class NETEQTEST_DummyRTPpacket : public NETEQTEST_RTPpacket {
public:
virtual int readFromFile(FILE* fp) OVERRIDE;
virtual int writeToFile(FILE* fp) OVERRIDE;
virtual void parseHeader() OVERRIDE;
};
#endif // NETEQTEST_DUMMYRTPPACKET_H

2
webrtc/modules/audio_coding/neteq4/test/NETEQTEST_RTPpacket.h
View File

@@ -37,7 +37,7 @@ public:
virtual int writeToFile(FILE *fp);
void blockPT(uint8_t pt);
//int16_t payloadType();
void parseHeader();
virtual void parseHeader();
void parseHeader(webrtc::WebRtcRTPHeader* rtp_header);
const webrtc::WebRtcRTPHeader* RTPinfo() const;
uint8_t * datagram() const;