High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the WebRTC component
ComponentCore
Bug ClassLogic Error
Tracker2027499
Fix commitbecff80db207 (firefox) +17/-3
CISA KEVNot listed
Creditedjmwebdevelopement
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
for
third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
modified

Files Changed

  • third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
  • third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
index 034fcd225f5..12aae063d68 100644
--- a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
@@ -224,20 +224,27 @@ void RtpPacket::ZeroMutableExtensions() {
   }
 }
 
-void RtpPacket::SetCsrcs(ArrayView<const uint32_t> csrcs) {
+void RtpPacket::SetCsrcs(std::span<const uint32_t> csrcs) {
   RTC_DCHECK_EQ(extensions_size_, 0);
   RTC_DCHECK_EQ(payload_size_, 0);
   RTC_DCHECK_EQ(padding_size_, 0);
   RTC_DCHECK_LE(csrcs.size(), 0x0fu);
   RTC_DCHECK_LE(kFixedHeaderSize + 4 * csrcs.size(), capacity());
+
+  if (csrcs.size() > kMaxCsrcs) {
+    RTC_LOG(LS_WARNING) << "Truncating CSRC list to spec length " << kMaxCsrcs
+                        << " from " << csrcs.size();
+    csrcs = csrcs.first(kMaxCsrcs);
+  }
+
   payload_offset_ = kFixedHeaderSize + 4 * csrcs.size();
+  buffer_.SetSize(payload_offset_);
   WriteAt(0, (data()[0] & 0xF0) | dchecked_cast<uint8_t>(csrcs.size()));
   size_t offset = kFixedHeaderSize;
   for (uint32_t csrc : csrcs) {
     ByteWriter<uint32_t>::WriteBigEndian(WriteAt(offset), csrc);
     offset += 4;
   }
-  buffer_.SetSize(payload_offset_);
 }
 
 ArrayView<uint8_t> RtpPacket::AllocateRawExtension(int id, size_t length) {
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
index 3d27520b106..e9288a4f5d4 100644
--- a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
+++ b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
@@ -14,6 +14,7 @@
 #include <cstdint>
 #include <cstring>
 #include <optional>
+#include <span>
 #include <string>
 #include <utility>
 #include <vector>
@@ -30,6 +31,12 @@ class RtpPacket {
   using ExtensionType = RTPExtensionType;
   using ExtensionManager = RtpHeaderExtensionMap;
 
+  // Maximum number of CSRCs in an RTP packet as specified in section
+  // "5.1 RTP Fixed Header Fields" of RFC 3550.
+  // Note: This is a different limit than the one that applies to RTCP packets
+  // (which is specified in section 6.1).
+  static constexpr size_t kMaxCsrcs = 15;
+
   // `extensions` required for SetExtension/ReserveExtension functions during
   // packet creating and used if available in Parse function.
   // Adding and getting extensions will fail until `extensions` is
@@ -118,7 +125,7 @@ class RtpPacket {
   // Writes csrc list. Assumes:
   // a) There is enough room left in buffer.
   // b) Extension headers, payload or padding data has not already been added.
-  void SetCsrcs(ArrayView<const uint32_t> csrcs);
+  void SetCsrcs(std::span<const uint32_t> csrcs);
 
   // Header extensions.
   template <typename Extension>
Loading diff…