commit 07ec26d1a9b697094fc8f92ec749d89d60ddea0f
author danilchap <danilchap@webrtc.org> Fri Jun 17 04:18:54 2016 -0700
committer Commit bot <commit-bot@chromium.org> Fri Jun 17 11:18:58 2016 +0000
tree a932b4c1783707358046677ff250a43f08291e13
parent 9b99499124792e5eb9342e670380d67d45f39e59

Fix crash parsing malformed rtp packet
where header extesnsion size mismatch expected.

Reland of https://codereview.webrtc.org/2067793003/

BUG=chromium:620242
R=åsapersson

Review-Url: https://codereview.webrtc.org/2060943009
Cr-Commit-Position: refs/heads/master@{#13187}

webrtc/modules/rtp_rtcp/source/rtp_packet.cc

diff --git a/webrtc/modules/rtp_rtcp/source/rtp_packet.cc b/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
index f663486..07aeb71 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
@@ -416,10 +416,13 @@
   RTC_DCHECK(offset);
   for (size_t i = 0; i < num_extensions_; ++i) {
     if (extension_entries_[i].type == type) {
-      RTC_CHECK_EQ(length, extension_entries_[i].length)
-          << "Length mismatch for extension '" << type << "'"
-          << "should be " << length << ", received "
-          << extension_entries_[i].length;
+      if (length != extension_entries_[i].length) {
+        LOG(LS_WARNING) << "Length mismatch for extension '" << type
+                        << "': expected " << static_cast<int>(length)
+                        << ", received "
+                        << static_cast<int>(extension_entries_[i].length);
+        return false;
+      }
       *offset = extension_entries_[i].offset;
       return true;
     }

webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc

diff --git a/webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc b/webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc
index b992d2d..c934222 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_packet_unittest.cc
@@ -31,6 +31,7 @@
 constexpr bool kVoiceActive = true;
 constexpr uint8_t kAudioLevel = 0x5a;
 constexpr size_t kMaxPaddingSize = 224u;
+// clang-format off
 constexpr uint8_t kMinimumPacket[] = {
     0x80, kPayloadType, 0x00, kSeqNum,
     0x65, 0x43, 0x12, 0x78,
@@ -64,6 +65,17 @@
     'p', 'a', 'y', 'l', 'o', 'a', 'd',
     'p', 'a', 'd', 'd', 'i', 'n', 'g', kPacketPaddingSize};
 
+constexpr uint8_t kPacketWithInvalidExtension[] = {
+    0x90, kPayloadType, 0x00, kSeqNum,
+    0x65, 0x43, 0x12, 0x78,  // kTimestamp.
+    0x12, 0x34, 0x56, 0x78,  // kSSrc.
+    0xbe, 0xde, 0x00, 0x02,  // Extension block of size 2 x 32bit words.
+    (kTransmissionOffsetExtensionId << 4) | 6,  // (6+1)-byte extension, but
+           'e',  'x',  't',                     // Transmission Offset
+     'd',  'a',  't',  'a',                     // expected to be 3-bytes.
+     'p',  'a',  'y',  'l',  'o',  'a',  'd'
+};
+// clang-format on
 }  // namespace
 
 TEST(RtpPacketTest, CreateMinimum) {
@@ -193,6 +205,24 @@
   EXPECT_EQ(0u, packet.padding_size());
 }
 
+TEST(RtpPacketTest, ParseWithInvalidSizedExtension) {
+  RtpPacketToSend::ExtensionManager extensions;
+  extensions.Register(kRtpExtensionTransmissionTimeOffset,
+                      kTransmissionOffsetExtensionId);
+
+  RtpPacketReceived packet(&extensions);
+  EXPECT_TRUE(packet.Parse(kPacketWithInvalidExtension,
+                           sizeof(kPacketWithInvalidExtension)));
+
+  // Extension should be ignored.
+  int32_t time_offset;
+  EXPECT_FALSE(packet.GetExtension<TransmissionOffset>(&time_offset));
+
+  // But shouldn't prevent reading payload.
+  EXPECT_THAT(make_tuple(packet.payload(), packet.payload_size()),
+              ElementsAreArray(kPayload));
+}
+
 TEST(RtpPacketTest, ParseWith2Extensions) {
   RtpPacketToSend::ExtensionManager extensions;
   extensions.Register(kRtpExtensionTransmissionTimeOffset,