tor-browser

commit b1283b86c642a9cfbf0bd4f50f23b326ca786645
parent 407e1b14411baad285a86a246daea911bc9acc8a
Author: Dan Baker <dbaker@mozilla.com>
Date:   Thu, 23 Oct 2025 17:19:18 -0600

Bug 1995393 - Vendor libwebrtc from 23a70510ae

Upstream commit: https://webrtc.googlesource.com/src/+/23a70510ae8247d2ce3238213c1379076ae45c26
    Fix crash when NALU header is too short in RtpPacketizerH265

    Bug: webrtc:439305142
    Change-Id: I4381ef529ecc529024ce20a6c259702aa3cfaefb
    Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/405120
    Reviewed-by: Evan Shrubsole <eshr@webrtc.org>
    Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
    Cr-Commit-Position: refs/heads/main@{#45376}

Diffstat:
M
third_party/libwebrtc/README.mozilla.last-vendor
 | 
4
++--
M
third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265.cc
 | 
5
+++--
M
third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265_unittest.cc
 | 
8
++++++++

3 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/third_party/libwebrtc/README.mozilla.last-vendor b/third_party/libwebrtc/README.mozilla.last-vendor
@@ -1,4 +1,4 @@
 # ./mach python dom/media/webrtc/third_party_build/vendor-libwebrtc.py --from-local /Users/danielbaker/elm/.moz-fast-forward/moz-libwebrtc --commit mozpatches libwebrtc
-libwebrtc updated from /Users/danielbaker/elm/.moz-fast-forward/moz-libwebrtc commit mozpatches on 2025-10-23T23:16:48.542499+00:00.
+libwebrtc updated from /Users/danielbaker/elm/.moz-fast-forward/moz-libwebrtc commit mozpatches on 2025-10-23T23:19:06.241495+00:00.
 # base of lastest vendoring
-44bf5109e6
+23a70510ae
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265.cc b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265.cc
@@ -29,8 +29,9 @@ namespace webrtc {
 RtpPacketizerH265::RtpPacketizerH265(ArrayView<const uint8_t> payload,
                                      PayloadSizeLimits limits)
     : limits_(limits), num_packets_left_(0) {
-  for (const auto& nalu : H264::FindNaluIndices(payload)) {
-    if (!nalu.payload_size) {
+  for (const H264::NaluIndex& nalu : H264::FindNaluIndices(payload)) {
+    if (nalu.payload_size < 2) {
+      // Payload size has to include NALU header which is fixed 2 bytes.
       input_fragments_.clear();
       return;
     }
diff --git a/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265_unittest.cc b/third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packetizer_h265_unittest.cc
@@ -534,6 +534,14 @@ TEST(RtpPacketizerH265Test, FuBig) {
       ElementsAre(1197, 1197, 1197, 1197, 1197, 1197, 1197, 1197, 1197, 1197));
 }
 
+// Invalid input tests.
+TEST(RtpPacketizerH265Test, TooShortNalUnitHeader) {
+  const uint8_t kFrame[] = {0, 0, 0, 1, 15};
+  RtpPacketizer::PayloadSizeLimits limits;
+  RtpPacketizerH265 packetizer(kFrame, limits);
+  EXPECT_EQ(packetizer.NumPackets(), 0u);
+}
+
 struct PacketInfo {
   bool first_fragment = false;
   bool last_fragment = false;