[Backport] Check number of nalus in packet before checking nalu types.

Bug: chromium:840536
Change-Id: Ia4dcf322ad6290691fd01b58fb02cd868714c92e
Reviewed-on: https://webrtc-review.googlesource.com/77121
Commit-Queue: Philip Eliasson <philipel@webrtc.org>
Reviewed-by: Stefan Holmer <stefan@webrtc.org>
Reviewed-by: Rasmus Brandt <brandtr@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23283}
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 49 insertions, 0 deletions

diff --git a/chromium/third_party/webrtc/modules/video_coding/packet_buffer.cc b/chromium/third_party/webrtc/modules/video_coding/packet_buffer.cc
index 741c11e2aac..0e619b2e900 100644
--- a/chromium/third_party/webrtc/modules/video_coding/packet_buffer.cc
+++ b/chromium/third_party/webrtc/modules/video_coding/packet_buffer.cc
@@ -298,6 +298,10 @@ std::vector<std::unique_ptr<RtpFrameObject>> PacketBuffer::FindFrames(
         if (is_h264 && !is_h264_keyframe) {
           const RTPVideoHeaderH264& header =
               data_buffer_[start_index].video_header.codecHeader.H264;
+
+          if (header.nalus_length >= kMaxNalusPerPacket)
+            return found_frames;
+
           for (size_t j = 0; j < header.nalus_length; ++j) {
             if (header.nalus[j].type == H264::NaluType::kSps) {
               has_h264_sps = true;
diff --git a/chromium/third_party/webrtc/modules/video_coding/video_packet_buffer_unittest.cc b/chromium/third_party/webrtc/modules/video_coding/video_packet_buffer_unittest.cc
index 893649364a7..67ab36db497 100644
--- a/chromium/third_party/webrtc/modules/video_coding/video_packet_buffer_unittest.cc
+++ b/chromium/third_party/webrtc/modules/video_coding/video_packet_buffer_unittest.cc
@@ -685,6 +685,51 @@ TEST_F(TestPacketBuffer, PacketTimestamps) {
   EXPECT_FALSE(packet_keyframe_ms);
 }
 
+TEST_F(TestPacketBuffer, IncomingCodecChange) {
+  VCMPacket packet;
+  packet.is_first_packet_in_frame = true;
+  packet.markerBit = true;
+  packet.sizeBytes = 0;
+  packet.dataPtr = nullptr;
+
+  packet.codec = kVideoCodecVP8;
+  packet.timestamp = 1;
+  packet.seqNum = 1;
+  packet.frameType = kVideoFrameKey;
+  EXPECT_TRUE(packet_buffer_->InsertPacket(&packet));
+
+  packet.codec = kVideoCodecH264;
+  packet.video_header.codecHeader.H264.nalus_length = 1;
+  packet.timestamp = 3;
+  packet.seqNum = 3;
+  EXPECT_TRUE(packet_buffer_->InsertPacket(&packet));
+
+  packet.codec = kVideoCodecVP8;
+  packet.timestamp = 2;
+  packet.seqNum = 2;
+  packet.frameType = kVideoFrameDelta;
+
+  EXPECT_TRUE(packet_buffer_->InsertPacket(&packet));
+
+  EXPECT_EQ(3UL, frames_from_callback_.size());
+}
+
+TEST_F(TestPacketBuffer, TooManyNalusInPacket) {
+  VCMPacket packet;
+  packet.codec = kVideoCodecH264;
+  packet.timestamp = 1;
+  packet.seqNum = 1;
+  packet.frameType = kVideoFrameKey;
+  packet.is_first_packet_in_frame = true;
+  packet.markerBit = true;
+  packet.video_header.codecHeader.H264.nalus_length = kMaxNalusPerPacket;
+  packet.sizeBytes = 0;
+  packet.dataPtr = nullptr;
+  EXPECT_TRUE(packet_buffer_->InsertPacket(&packet));
+
+  EXPECT_EQ(0UL, frames_from_callback_.size());
+}
+
 TEST_P(TestPacketBufferH264Parameterized, OneFrameFillBuffer) {
   InsertH264(0, kKeyFrame, kFirst, kNotLast, 1000);
   for (int i = 1; i < kStartSize - 1; ++i)