Fixing heap read overflow when "sctp-port" is in a video description.
This added an SCTP codec, which is later re-interpreted as a video
codec. We shouldn't be adding codecs that don't match the type of the
media description.
BUG=chromium:648062
Review-Url: https://codereview.webrtc.org/2354723002
Cr-Commit-Position: refs/heads/master@{#14421}
diff --git a/webrtc/api/webrtcsdp.cc b/webrtc/api/webrtcsdp.cc
index 7238131..4df4ef8 100644
--- a/webrtc/api/webrtcsdp.cc
+++ b/webrtc/api/webrtcsdp.cc
@@ -2651,6 +2651,11 @@
return false;
}
} else if (IsDtlsSctp(protocol) && HasAttribute(line, kAttributeSctpPort)) {
+ if (media_type != cricket::MEDIA_TYPE_DATA) {
+ return ParseFailed(
+ line, "sctp-port attribute found in non-data media description.",
+ error);
+ }
int sctp_port;
if (!ParseSctpPort(line, &sctp_port, error)) {
return false;