From 34505048c030ee72ad6ee99f46534861ebb0e365 Mon Sep 17 00:00:00 2001
From: Tommi <tommi@webrtc.org>
Date: Mon, 18 May 2026 08:36:02 +0200
Subject: [PATCH] Cap RTCConfiguration certificates and enforce 32-bit overflow checks

1. Bounded the maximum number of certificates in RTCConfiguration to
   1000 to prevent reference counter overflow while maintaining ample
   headroom for legitimate multi-algorithm DTLS interoperability.
2. Updated webrtc_impl::RefCounter to declare IncRef() out-of-line
   unconditionally across all architectures.
3. Implemented RefCounter::IncRef() out-of-line in ref_counter.cc with
   an explicit RTC_CHECK_LT(prev, INT_MAX) guard on all architectures,
   preventing 32-bit integer overflow and Use-After-Free vulnerabilities
   unconditionally without causing inlined binary bloat.

Bug: chromium:513154132
Fixed: chromium:513154132
Change-Id: I9894ef08519423b24139b0250cc9da0f9737827a
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/472722
Commit-Queue: Tomas Gunnarsson <tommi@webrtc.org>
Reviewed-by: Harald Alvestrand <hta@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47722}
---

diff --git a/api/peer_connection_interface.h b/api/peer_connection_interface.h
index 6c51d77..da0f292 100644
--- a/api/peer_connection_interface.h
+++ b/api/peer_connection_interface.h
@@ -417,6 +417,10 @@
     static const int kAudioJitterBufferMaxPackets = 200;
     // ICE connection receiving timeout for aggressive configuration.
     static const int kAggressiveIceConnectionReceivingTimeout = 1000;
+    // Maximum number of certificates allowed in the configuration.
+    // Capped at 1000 which still provides ample headroom for interoperability
+    // of multiple key algorithms.
+    static const int kMaxCertificates = 1000;
 
     ////////////////////////////////////////////////////////////////////////
     // The below few fields mirror the standard RTCConfiguration dictionary:
diff --git a/pc/peer_connection_factory.cc b/pc/peer_connection_factory.cc
index d36b766..9e9e402 100644
--- a/pc/peer_connection_factory.cc
+++ b/pc/peer_connection_factory.cc
@@ -240,6 +240,12 @@
     return err;
   }
 
+  if (configuration.certificates.size() >
+      PeerConnectionInterface::RTCConfiguration::kMaxCertificates) {
+    return RTCError(RTCErrorType::INVALID_PARAMETER,
+                    "Too many certificates in RTCConfiguration.");
+  }
+
   ServerAddresses stun_servers;
   std::vector<RelayServerConfig> turn_servers;
   err = ParseAndValidateIceServersFromConfiguration(configuration, stun_servers,
diff --git a/rtc_base/BUILD.gn b/rtc_base/BUILD.gn
index f156680..5a306a6 100644
--- a/rtc_base/BUILD.gn
+++ b/rtc_base/BUILD.gn
@@ -459,14 +459,19 @@
   deps = [ ":checks" ]
 }
 
-rtc_source_set("refcount") {
+rtc_library("refcount") {
   visibility = [ "*" ]
   sources = [
     "ref_count.h",
     "ref_counted_object.h",
+    "ref_counter.cc",
     "ref_counter.h",
   ]
-  deps = [ "../api:ref_count" ]
+  deps = [
+    ":checks",
+    "../api:ref_count",
+    "system:rtc_export",
+  ]
 }
 
 rtc_library("criticalsection") {
diff --git a/rtc_base/ref_counter.cc b/rtc_base/ref_counter.cc
new file mode 100644
index 0000000..bc3c6a7
--- /dev/null
+++ b/rtc_base/ref_counter.cc
@@ -0,0 +1,30 @@
+/*
+ *  Copyright 2026 The WebRTC Project Authors. All rights reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "rtc_base/ref_counter.h"
+
+#include <atomic>
+#include <climits>
+
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+namespace webrtc_impl {
+
+void RefCounter::IncRef() {
+  // Relaxed memory order: The current thread is allowed to act on the
+  // resource protected by the reference counter both before and after the
+  // atomic op, so this function doesn't prevent memory access reordering.
+  int prev = ref_count_.fetch_add(1, std::memory_order_relaxed);
+  RTC_CHECK_LT(prev, INT_MAX);
+}
+
+}  // namespace webrtc_impl
+}  // namespace webrtc
diff --git a/rtc_base/ref_counter.h b/rtc_base/ref_counter.h
index af25391..6e52e4e 100644
--- a/rtc_base/ref_counter.h
+++ b/rtc_base/ref_counter.h
@@ -13,21 +13,17 @@
 #include <atomic>
 
 #include "api/ref_count.h"
+#include "rtc_base/system/rtc_export.h"
 
 namespace webrtc {
 namespace webrtc_impl {
 
-class RefCounter {
+class RTC_EXPORT RefCounter {
  public:
   explicit RefCounter(int ref_count) : ref_count_(ref_count) {}
   RefCounter() = delete;
 
-  void IncRef() {
-    // Relaxed memory order: The current thread is allowed to act on the
-    // resource protected by the reference counter both before and after the
-    // atomic op, so this function doesn't prevent memory access reordering.
-    ref_count_.fetch_add(1, std::memory_order_relaxed);
-  }
+  void IncRef();
 
   // Returns kDroppedLastRef if this call dropped the last reference; the caller
   // should therefore free the resource protected by the reference counter.