mirror of
https://github.com/mollyim/webrtc.git
synced 2025-05-15 06:40:43 +01:00
584b4df92d
If a FORWARD-TSN contains an ordered skipped stream with a large TSN but with a too small SSN, it can result in messages being assembled that should've been skipped. Typically: Receive DATA, ordered, complete, TSN=10, SID=1, SSN=0 - will be delivered. Receive DATA, ordered, complete, TSN=43, SID=1, SSN=7 - will stay in queue, due to missing SSN=1,2,3,4,5,6. Receive FORWARD-TSN, TSN=44, SSN=6 - is invalid, as the SSN should've been 7 or higher. However, as the TSN isn't used for removing messages in ordered streams, but just the SSN, the SSN=7 isn't removed but instead will be delivered as it's the next following SSN after 6. This will trigger internal consistency checks as a chunk with TSN=43 will be delivered when the current cumulative TSN is set to 44, which is greater. This was found when fuzzing, and can only be provoked by a client that is intentionally misbehaving. Before this fix, there was no harm done, but it failed consistency checks which fuzzers have enabled. When bug 13799 was fixed (in a previous commit), this allowed the fuzzers to find it faster. Bug: webrtc:13799 Change-Id: I830ef189476e227e1dbe08157d34f96ad6453e30 Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/254240 Reviewed-by: Harald Alvestrand <hta@webrtc.org> Commit-Queue: Victor Boivie <boivie@webrtc.org> Cr-Commit-Position: refs/heads/main@{#36157} |
||
|---|---|---|
| .. | ||
| abort_chunk.cc | ||
| abort_chunk.h | ||
| abort_chunk_test.cc | ||
| chunk.cc | ||
| chunk.h | ||
| cookie_ack_chunk.cc | ||
| cookie_ack_chunk.h | ||
| cookie_ack_chunk_test.cc | ||
| cookie_echo_chunk.cc | ||
| cookie_echo_chunk.h | ||
| cookie_echo_chunk_test.cc | ||
| data_chunk.cc | ||
| data_chunk.h | ||
| data_chunk_test.cc | ||
| data_common.h | ||
| error_chunk.cc | ||
| error_chunk.h | ||
| error_chunk_test.cc | ||
| forward_tsn_chunk.cc | ||
| forward_tsn_chunk.h | ||
| forward_tsn_chunk_test.cc | ||
| forward_tsn_common.h | ||
| heartbeat_ack_chunk.cc | ||
| heartbeat_ack_chunk.h | ||
| heartbeat_ack_chunk_test.cc | ||
| heartbeat_request_chunk.cc | ||
| heartbeat_request_chunk.h | ||
| heartbeat_request_chunk_test.cc | ||
| idata_chunk.cc | ||
| idata_chunk.h | ||
| idata_chunk_test.cc | ||
| iforward_tsn_chunk.cc | ||
| iforward_tsn_chunk.h | ||
| iforward_tsn_chunk_test.cc | ||
| init_ack_chunk.cc | ||
| init_ack_chunk.h | ||
| init_ack_chunk_test.cc | ||
| init_chunk.cc | ||
| init_chunk.h | ||
| init_chunk_test.cc | ||
| reconfig_chunk.cc | ||
| reconfig_chunk.h | ||
| reconfig_chunk_test.cc | ||
| sack_chunk.cc | ||
| sack_chunk.h | ||
| sack_chunk_test.cc | ||
| shutdown_ack_chunk.cc | ||
| shutdown_ack_chunk.h | ||
| shutdown_ack_chunk_test.cc | ||
| shutdown_chunk.cc | ||
| shutdown_chunk.h | ||
| shutdown_chunk_test.cc | ||
| shutdown_complete_chunk.cc | ||
| shutdown_complete_chunk.h | ||
| shutdown_complete_chunk_test.cc | ||