@@ -570,65 +570,76 @@ void PeerConnection::dispatchMedia([[maybe_unused]] message_ptr message) {
570570 if (message->type == Message::Control) {
571571 std::set<uint32_t > ssrcs;
572572 size_t offset = 0 ;
573- while (( sizeof (RtcpHeader) + offset ) <= message->size ()) {
573+ while (offset + sizeof (RtcpHeader ) <= message->size ()) {
574574 auto header = reinterpret_cast <RtcpHeader *>(message->data () + offset);
575- if (header->lengthInBytes () > message->size () - offset) {
575+ size_t length = header->lengthInBytes ();
576+ if (offset + length > message->size ()) {
576577 COUNTER_MEDIA_TRUNCATED++;
577578 break ;
578579 }
579- offset += header->lengthInBytes ();
580- if (header->payloadType () == 205 ) {
581- auto rtcpfb = reinterpret_cast <RtcpFbHeader *>(header);
582- ssrcs.insert (rtcpfb->packetSenderSSRC ());
583- ssrcs.insert (rtcpfb->mediaSourceSSRC ());
584- } else if (header->payloadType () == 206 ) {
585- auto rtcpfb = reinterpret_cast <RtcpFbHeader *>(header);
586- ssrcs.insert (rtcpfb->packetSenderSSRC ());
587- if (header->reportCount () == 15 && header->lengthInBytes () >= sizeof (RtcpRemb)) {
588- auto remb = reinterpret_cast <RtcpRemb *>(header);
589- unsigned numSsrc = remb->getNumSSRC ();
590- if (RtcpRemb::SizeWithSSRCs (numSsrc) > message->size () + header->lengthInBytes () - offset) {
580+ switch (header->payloadType ()) {
581+ case 200 : // SR
582+ if (length >= sizeof (RtcpSr)) {
583+ auto rtcpsr = reinterpret_cast <RtcpSr *>(header);
584+ ssrcs.insert (rtcpsr->senderSSRC ());
585+ for (int i = 0 ; i < rtcpsr->header .reportCount (); ++i)
586+ if (const auto *reportBlock = rtcpsr->getReportBlock (i))
587+ ssrcs.insert (reportBlock->getSSRC ());
588+ }
589+ break ;
590+
591+ case 201 : // RR
592+ if (length >= sizeof (RtcpRr)) {
593+ auto rtcprr = reinterpret_cast <RtcpRr *>(header);
594+ ssrcs.insert (rtcprr->senderSSRC ());
595+ for (int i = 0 ; i < rtcprr->header .reportCount (); ++i)
596+ if (const auto *reportBlock = rtcprr->getReportBlock (i))
597+ ssrcs.insert (reportBlock->getSSRC ());
598+ }
599+ break ;
600+
601+ case 202 : // SDES
602+ if (length >= sizeof (RtcpSdes)) {
603+ auto sdes = reinterpret_cast <RtcpSdes *>(header);
604+ if (!sdes->isValid ()) {
605+ PLOG_WARNING << " RTCP SDES packet is invalid" ;
591606 continue ;
592607 }
593- if (remb->_id [0 ] == ' R' && remb->_id [1 ] == ' E' && remb->_id [2 ] == ' M' && remb->_id [3 ] == ' B' ) {
594- for (unsigned i = 0 ; i < numSsrc; i++) {
595- ssrcs.insert (remb->getSSRC (i));
596- }
597- continue ;
608+ for (unsigned int i = 0 ; i < sdes->chunksCount (); i++) {
609+ auto chunk = sdes->getChunk (i);
610+ ssrcs.insert (chunk->ssrc ());
598611 }
599612 }
600- ssrcs.insert (rtcpfb->mediaSourceSSRC ());
601- } else if (header->payloadType () == 200 ) {
602- auto rtcpsr = reinterpret_cast <RtcpSr *>(header);
603- ssrcs.insert (rtcpsr->senderSSRC ());
604- for (int i = 0 ; i < rtcpsr->header .reportCount (); ++i)
605- if (const auto *reportBlock = rtcpsr->getReportBlock (i))
606- ssrcs.insert (reportBlock->getSSRC ());
607- } else if (header->payloadType () == 201 ) {
608- auto rtcprr = reinterpret_cast <RtcpRr *>(header);
609- ssrcs.insert (rtcprr->senderSSRC ());
610- for (int i = 0 ; i < rtcprr->header .reportCount (); ++i)
611- if (const auto *reportBlock = rtcprr->getReportBlock (i))
612- ssrcs.insert (reportBlock->getSSRC ());
613- } else if (header->payloadType () == 202 ) {
614- auto sdes = reinterpret_cast <RtcpSdes *>(header);
615- if (!sdes->isValid ()) {
616- PLOG_WARNING << " RTCP SDES packet is invalid" ;
617- continue ;
618- }
619- for (unsigned int i = 0 ; i < sdes->chunksCount (); i++) {
620- auto chunk = sdes->getChunk (i);
621- ssrcs.insert (chunk->ssrc ());
613+ break ;
614+
615+
616+ case 205 : // FB
617+ case 206 :
618+ if (length >= sizeof (RtcpFbHeader)) {
619+ auto rtcpfb = reinterpret_cast <RtcpFbHeader *>(header);
620+ ssrcs.insert (rtcpfb->packetSenderSSRC ());
621+ ssrcs.insert (rtcpfb->mediaSourceSSRC ());
622+ if (header->payloadType () == 206 && header->reportCount () == 15 &&
623+ length >= sizeof (RtcpRemb)) {
624+ auto remb = reinterpret_cast <RtcpRemb *>(header);
625+ if (remb->hasValidId ())
626+ for (int i = 0 ; i < remb->getSSRCCount (); ++i)
627+ ssrcs.insert (remb->getSSRC (i));
628+ }
622629 }
623- } else {
630+ break ;
631+
632+ default :
624633 // PT=203 == Goodbye
625634 // PT=204 == Application Specific
626635 // PT=207 == Extended Report
627636 if (header->payloadType () != 203 && header->payloadType () != 204 &&
628637 header->payloadType () != 207 ) {
629638 COUNTER_UNKNOWN_PACKET_TYPE++;
630639 }
640+ break ;
631641 }
642+ offset += header->lengthInBytes ();
632643 }
633644
634645 if (!ssrcs.empty ()) {
0 commit comments