1480173 - Overflow in FEC Processing (Project Zero)

Status: RESOLVED DUPLICATE of bug 1480088

(Core :: WebRTC: Audio/Video, defect, P1)

Description

[Nils Ohlmeier [:drno]]

Project Zero found a problem in processing RED packets: https://bugs.chromium.org/p/project-zero/issues/detail?id=1573

By default RED support is preffed off in Firefox.

As the Chrome bug is again not public yet going from the stack trace in the Project Zero report it looks like Firefox is affected:
https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc#173

Because the buffer size is fixed to 1500 bytes:
https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/forward_error_correction.h#42
https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/include/rtp_rtcp_defines.h#24