mollyim/webrtc
1
0
Fork 0
mirror of https://github.com/mollyim/webrtc.git synced 2025-05-14 22:30:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
webrtc/modules/video_coding
History
Chema Gonzalez afdbf8e6f8 H264: Fix stap-a-to-annex-b loop over-read 
While converting the aggregated (stap-a) packet transform packet
framing input into an annex-b framing copy, the two loops (both the
required size calculation and the stap-a-to-annex-b copy) may
over-read the input buffer.

In both buffers, `nalu_ptr` follows the input (stap-a) buffer, which
is located in `data`, and whose length is `data_size`. Buffer is read
until `nalu_ptr` reaches the end of the buffer. Issues is that the 5th
line in the loop:

```
    uint16_t segment_length = nalu_ptr[0] << 8 | nalu_ptr[1];
```

This line accesses `nalu_ptr[1]`, which needs to be protected in
the loop condition. Let's assume `data_size = 4`, and that we restart
the loop with `nalu_ptr = data + 3`. The condition of the loop does
hold (`nalu_ptr = data + 3 < data + data_size`), but the 5th line
will access to `data[3+1] = data[4]`, which is an over-read.

Tested:

```
$ ninja -C out/Default
$ out/Default/modules_unittests --gtest_filter=PacketBuffer*:H264*:RtpPacketizerH264Test*:VideoRtpDepacketizerH264Test*:TestH264SpsPpsTracker* --logs
...
[  PASSED  ] 97 tests.
```

Change-Id: I8b8aaf7d12b0bb154430b8922f099cd49e684762
Bug: webrtc:11698
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/177140
Reviewed-by: Sergey Silkin <ssilkin@webrtc.org>
Reviewed-by: Rasmus Brandt <brandtr@webrtc.org>
Commit-Queue: Niklas Enbom <niklas.enbom@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#31561}
2020-06-24 21:54:45 +00:00
..
codecs Share constants for dependency descriptor rtp header extension 2020-06-22 11:58:29 +00:00
deprecated Deprecate webrtc::NackModule. 2020-05-30 16:34:44 +00:00
include Delete header file mock_vcm_callbacks.h 2020-02-04 14:20:46 +00:00
test Include module_common_types.h only where needed 2019-09-24 08:22:38 +00:00
utility Reland "VP9 decoder: Sets thread count based on resolution, reinit on change." 2020-06-15 19:14:52 +00:00
BUILD.gn Factor encoded frame generation code into own target 2020-06-15 12:25:06 +00:00
chain_diff_calculator.cc Introduce ChainDiffCalculator 2020-05-18 14:22:44 +00:00
chain_diff_calculator.h Introduce ChainDiffCalculator 2020-05-18 14:22:44 +00:00
chain_diff_calculator_unittest.cc Introduce ChainDiffCalculator 2020-05-18 14:22:44 +00:00
codec_timer.cc [Cleanup] Add missing #include. Remove useless ones. IWYU part 2. 2018-11-28 18:25:07 +00:00
codec_timer.h Include module_common_types.h only where needed 2019-09-24 08:22:38 +00:00
decoder_database.cc Log decoder implementation name 2020-05-19 12:23:30 +00:00
decoder_database.h Refactoring PayloadRouter. 2018-07-17 14:46:15 +00:00
decoding_state.cc Concatenate string literals at compile time. 2020-01-14 14:47:48 +00:00
decoding_state.h Delete root header file typedef.h. 2018-07-25 14:59:26 +00:00
decoding_state_unittest.cc Format almost everything. 2019-07-08 13:45:15 +00:00
DEPS Add RTC_EXPORT to VCMEncodedFrame 2020-02-28 16:59:10 +00:00
encoded_frame.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
encoded_frame.h Removed unused function EncodedFrame::SetEncodedSize. 2020-05-04 16:44:12 +00:00
event_wrapper.cc Move EventWrapper class to target video_coding_legacy. 2020-03-06 08:39:35 +00:00
event_wrapper.h Move EventWrapper class to target video_coding_legacy. 2020-03-06 08:39:35 +00:00
fec_controller_default.cc Format almost everything. 2019-07-08 13:45:15 +00:00
fec_controller_default.h Format almost everything. 2019-07-08 13:45:15 +00:00
fec_controller_unittest.cc Format almost everything. 2019-07-08 13:45:15 +00:00
fec_rate_table.h
frame_buffer.cc Refactor legacy FrameBuffer to use EncodedImageBuffer::Realloc 2019-09-30 09:48:26 +00:00
frame_buffer.h Refactor legacy FrameBuffer to use EncodedImageBuffer::Realloc 2019-09-30 09:48:26 +00:00
frame_buffer2.cc Update call expectations in ReceiveStatisticsProxy, add thread checks 2020-05-20 10:27:50 +00:00
frame_buffer2.h Update call expectations in ReceiveStatisticsProxy, add thread checks 2020-05-20 10:27:50 +00:00
frame_buffer2_unittest.cc In media/ and modules/video_coding replace mock macros with unified MOCK_METHOD macro 2020-05-25 08:46:30 +00:00
frame_dependencies_calculator.cc Populate generic descriptor based on GenericFrameInfo when available. 2020-02-12 10:55:41 +00:00
frame_dependencies_calculator.h Populate generic descriptor based on GenericFrameInfo when available. 2020-02-12 10:55:41 +00:00
frame_dependencies_calculator_unittest.cc Add helper to calculate frame dependencies based on encoder buffer usage 2020-02-05 16:19:10 +00:00
frame_object.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
frame_object.h Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
generic_decoder.cc Log decoder implementation name 2020-05-19 12:23:30 +00:00
generic_decoder.h Log decoder implementation name 2020-05-19 12:23:30 +00:00
generic_decoder_unittest.cc Add processing time to VideoFrame 2020-01-16 14:11:15 +00:00
h264_sprop_parameter_sets.cc Format almost everything. 2019-07-08 13:45:15 +00:00
h264_sprop_parameter_sets.h (4) Rename files to snake_case: update BUILD.gn, include paths, header guards, and DEPS entries 2019-01-11 17:11:39 +00:00
h264_sprop_parameter_sets_unittest.cc Fully qualify googletest symbols. 2019-04-09 17:18:20 +00:00
h264_sps_pps_tracker.cc H264: Fix stap-a-to-annex-b loop over-read 2020-06-24 21:54:45 +00:00
h264_sps_pps_tracker.h in PacketBuffer::Packet pass payload using smart buffer 2019-12-03 14:55:54 +00:00
h264_sps_pps_tracker_unittest.cc in PacketBuffer::Packet pass payload using smart buffer 2019-12-03 14:55:54 +00:00
histogram.cc [Cleanup] Add missing #include. Remove useless ones. IWYU part 2. 2018-11-28 18:25:07 +00:00
histogram.h
histogram_unittest.cc Format almost everything. 2019-07-08 13:45:15 +00:00
inter_frame_delay.cc Remove unused method in VCMInterFrameDelay. 2019-04-03 07:35:28 +00:00
inter_frame_delay.h Remove unused method in VCMInterFrameDelay. 2019-04-03 07:35:28 +00:00
internal_defines.h Remove unused defines and methods in internal_defines.h 2019-01-28 10:31:40 +00:00
jitter_buffer.cc Trim dependencies in modules/video_coding/ 2019-09-11 09:31:10 +00:00
jitter_buffer.h Move EventWrapper class to target video_coding_legacy. 2020-03-06 08:39:35 +00:00
jitter_buffer_common.h Format almost everything. 2019-07-08 13:45:15 +00:00
jitter_buffer_unittest.cc Format almost everything. 2019-07-08 13:45:15 +00:00
jitter_estimator.cc Add option to disable reduced jitter delay through field trial. 2020-05-19 11:51:29 +00:00
jitter_estimator.h Add option to disable reduced jitter delay through field trial. 2020-05-19 11:51:29 +00:00
jitter_estimator_tests.cc Add option to disable reduced jitter delay through field trial. 2020-05-19 11:51:29 +00:00
loss_notification_controller.cc Detach LossNotificationController from RtpGenericFrameDescriptor 2020-01-24 11:53:28 +00:00
loss_notification_controller.h Detach LossNotificationController from RtpGenericFrameDescriptor 2020-01-24 11:53:28 +00:00
loss_notification_controller_unittest.cc Detach LossNotificationController from RtpGenericFrameDescriptor 2020-01-24 11:53:28 +00:00
media_opt_util.cc Stop checking VP8BaseHeavyTl3RateAllocation field trial on every frame. 2019-11-04 13:50:59 +00:00
media_opt_util.h Stop checking VP8BaseHeavyTl3RateAllocation field trial on every frame. 2019-11-04 13:50:59 +00:00
nack_module2.cc Remove locks and dependency on ProcessThread+Module from NackModule2. 2020-05-27 14:20:34 +00:00
nack_module2.h Remove locks and dependency on ProcessThread+Module from NackModule2. 2020-05-27 14:20:34 +00:00
nack_module2_unittest.cc Remove locks and dependency on ProcessThread+Module from NackModule2. 2020-05-27 14:20:34 +00:00
nack_module_unittest.cc Deprecate webrtc::NackModule. 2020-05-30 16:34:44 +00:00
OWNERS Remove wildcard ownership for build files. 2020-02-19 14:05:46 +00:00
packet.cc Add plumbing of RtpPacketInfos to each VideoFrame as input for SourceTracker. 2019-06-20 10:24:29 +00:00
packet.h Add plumbing of RtpPacketInfos to each VideoFrame as input for SourceTracker. 2019-06-20 10:24:29 +00:00
packet_buffer.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
packet_buffer.h Introduces rtc_base/synchronization/mutex.h. 2020-06-04 09:55:12 +00:00
packet_buffer_unittest.cc Move AssembleFrame from PacketBuffer to RtpVideoStreamReceiver 2020-03-19 16:35:14 +00:00
receiver.cc Concatenate string literals at compile time. 2020-01-14 14:47:48 +00:00
receiver.h Move EventWrapper class to target video_coding_legacy. 2020-03-06 08:39:35 +00:00
receiver_unittest.cc Move EventWrapper class to target video_coding_legacy. 2020-03-06 08:39:35 +00:00
rtp_frame_reference_finder.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
rtp_frame_reference_finder.h Detach RtpFrameReferenceFinder from RtpGenericFrameDescriptor 2020-01-29 12:36:10 +00:00
rtp_frame_reference_finder_unittest.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
rtt_filter.cc Fix typo in VCMRttFilter 2018-01-26 10:59:56 +00:00
rtt_filter.h Delete root header file typedef.h. 2018-07-25 14:59:26 +00:00
session_info.cc Remove framemarking RTP extension. 2020-06-15 11:18:00 +00:00
session_info.h Format almost everything. 2019-07-08 13:45:15 +00:00
session_info_unittest.cc Include module_common_types.h only where needed 2019-09-24 08:22:38 +00:00
timestamp_map.cc Format almost everything. 2019-07-08 13:45:15 +00:00
timestamp_map.h Remove unimplemented function declarations VCMGenericDecoder::External and VCMTimestampMap::Reset. 2018-09-06 09:05:30 +00:00
timing.cc Format almost everything. 2019-07-08 13:45:15 +00:00
timing.h Include module_common_types.h only where needed 2019-09-24 08:22:38 +00:00
timing_unittest.cc Format almost everything. 2019-07-08 13:45:15 +00:00
unique_timestamp_counter.cc Split out counting unique rtp timestamps from packet_buffer 2019-10-30 15:27:48 +00:00
unique_timestamp_counter.h Split out counting unique rtp timestamps from packet_buffer 2019-10-30 15:27:48 +00:00
unique_timestamp_counter_unittest.cc Split out counting unique rtp timestamps from packet_buffer 2019-10-30 15:27:48 +00:00
video_codec_initializer.cc Fix vp9 svc singlecast mode and enable quality scaler for vp9 2020-06-18 21:24:46 +00:00
video_codec_initializer_unittest.cc Make RtpEncodingParameters to not reverse active flags order 2020-02-05 17:36:26 +00:00
video_coding_defines.cc Fix frames dropped statistics 2019-08-27 07:43:01 +00:00
video_coding_impl.cc Delete deprecated method VideoCodingModule::SetReceiverRobustnessMode 2019-06-12 06:39:38 +00:00
video_coding_impl.h Remove seemingly unused timer 2020-04-03 11:17:02 +00:00
video_receiver.cc Remove seemingly unused timer 2020-04-03 11:17:02 +00:00
video_receiver2.cc Add processing time to VideoFrame 2020-01-16 14:11:15 +00:00
video_receiver2.h Delete VideoReceiver2::TriggerDecoderShutdown. 2019-09-12 13:44:13 +00:00
video_receiver_unittest.cc In media/ and modules/video_coding replace mock macros with unified MOCK_METHOD macro 2020-05-25 08:46:30 +00:00