commit a64a2fbf6d92d18e77f813212905bb5eb89799b5
author Danil Chapovalov <danilchap@webrtc.org> Mon Sep 12 11:41:35 2016 +0200
committer Danil Chapovalov <danilchap@webrtc.org> Mon Sep 12 09:41:44 2016 +0000
tree c6bc9835ca08d0694c7e6be865dfc3ee715f7d78
parent 180e4525ca7c9a23602cdf37a8756df7d23e7143

Fix oversized rtp extension parsing.
When size of individual one-byte extension span beyound extension block

BUG=chromium:645201
R=brandtr@webrtc.org

Review URL: https://codereview.webrtc.org/2327743003 .

Cr-Commit-Position: refs/heads/master@{#14183}

webrtc/modules/rtp_rtcp/source/rtp_packet.cc

diff --git a/webrtc/modules/rtp_rtcp/source/rtp_packet.cc b/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
index 8c8fa0e..283512c 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_packet.cc
@@ -11,6 +11,7 @@
 #include "webrtc/modules/rtp_rtcp/source/rtp_packet.h"
 
 #include <cstring>
+#include <utility>
 
 #include "webrtc/base/checks.h"
 #include "webrtc/base/logging.h"
@@ -397,11 +398,16 @@
         }
         uint8_t length =
             1 + (buffer[extension_offset + extensions_size_] & 0xf);
-        extensions_size_ += kOneByteHeaderSize;
-        if (num_extensions_ >= kMaxExtensionHeaders) {
-          LOG(LS_WARNING) << "Too many extensions.";
-          return false;
+        if (extensions_size_ + kOneByteHeaderSize + length >
+            extensions_capacity) {
+          LOG(LS_WARNING) << "Oversized rtp header extension.";
+          break;
         }
+        if (num_extensions_ >= kMaxExtensionHeaders) {
+          LOG(LS_WARNING) << "Too many rtp header extensions.";
+          break;
+        }
+        extensions_size_ += kOneByteHeaderSize;
         extension_entries_[num_extensions_].type =
             extensions_ ? extensions_->GetType(id)
                         : ExtensionManager::kInvalidType;