Firefox · Core
CVE-2026-6752
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forthird_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc |
modified |
Files Changed
third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.ccthird_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
Patch
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
index 034fcd225f5..12aae063d68 100644
--- a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
+++ b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc
@@ -224,20 +224,27 @@ void RtpPacket::ZeroMutableExtensions() {
}
}
-void RtpPacket::SetCsrcs(ArrayView<const uint32_t> csrcs) {
+void RtpPacket::SetCsrcs(std::span<const uint32_t> csrcs) {
RTC_DCHECK_EQ(extensions_size_, 0);
RTC_DCHECK_EQ(payload_size_, 0);
RTC_DCHECK_EQ(padding_size_, 0);
RTC_DCHECK_LE(csrcs.size(), 0x0fu);
RTC_DCHECK_LE(kFixedHeaderSize + 4 * csrcs.size(), capacity());
+
+ if (csrcs.size() > kMaxCsrcs) {
+ RTC_LOG(LS_WARNING) << "Truncating CSRC list to spec length " << kMaxCsrcs
+ << " from " << csrcs.size();
+ csrcs = csrcs.first(kMaxCsrcs);
+ }
+
payload_offset_ = kFixedHeaderSize + 4 * csrcs.size();
+ buffer_.SetSize(payload_offset_);
WriteAt(0, (data()[0] & 0xF0) | dchecked_cast<uint8_t>(csrcs.size()));
size_t offset = kFixedHeaderSize;
for (uint32_t csrc : csrcs) {
ByteWriter<uint32_t>::WriteBigEndian(WriteAt(offset), csrc);
offset += 4;
}
- buffer_.SetSize(payload_offset_);
}
ArrayView<uint8_t> RtpPacket::AllocateRawExtension(int id, size_t length) {
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
index 3d27520b106..e9288a4f5d4 100644
--- a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
+++ b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.h
@@ -14,6 +14,7 @@
#include <cstdint>
#include <cstring>
#include <optional>
+#include <span>
#include <string>
#include <utility>
#include <vector>
@@ -30,6 +31,12 @@ class RtpPacket {
using ExtensionType = RTPExtensionType;
using ExtensionManager = RtpHeaderExtensionMap;
+ // Maximum number of CSRCs in an RTP packet as specified in section
+ // "5.1 RTP Fixed Header Fields" of RFC 3550.
+ // Note: This is a different limit than the one that applies to RTCP packets
+ // (which is specified in section 6.1).
+ static constexpr size_t kMaxCsrcs = 15;
+
// `extensions` required for SetExtension/ReserveExtension functions during
// packet creating and used if available in Parse function.
// Adding and getting extensions will fail until `extensions` is
@@ -118,7 +125,7 @@ class RtpPacket {
// Writes csrc list. Assumes:
// a) There is enough room left in buffer.
// b) Extension headers, payload or padding data has not already been added.
- void SetCsrcs(ArrayView<const uint32_t> csrcs);
+ void SetCsrcs(std::span<const uint32_t> csrcs);
// Header extensions.
template <typename Extension>
Loading diff…
References
On This Page