Repository navigation
`sdp::Utils parses SDP strings without validating them (crashes) #220
Description
src/sdp/Utils.cpp is the only file that parses raw SDP, and it does so with no validation at all. #192 was one example of the problem, fixed by PR #218. These are the remaining ones:
1. a=rtcp-fb with a * payload aborts (extractRtpCapabilities())
auto jsonCodecIt = codecsMap.find(std::stoi(fb["payload"].get<std::string>()));
SDP allows '*' as the payload, meaning "apply to all codecs" (`a=rtcp-fb:* nack`). In this case, `std::stoi("*")` throws `std::invalid_argument` which is never caught.
mediasoup-client handles it: when the payload is '*' the feedback is pushed to every codec of the same kind, except RTX codecs (see [commonUtils.ts](https://github.com/versatica/mediasoup-client/blob/v3/src/handlers/sdp/commonUtils.ts)).
2. `Utils::Split()` results indexed without checking the size.
`addLegacySimulcast()` (lines 298-300 and 328-332) and `getRtpEncodings()` (lines 523-525) do `auto v = Utils::Split(...)` and then read `v[0]` and `v[1]`. An `a=ssrc:X msid:stream-id` line with no track id, or a malformed `a=ssrc-group` line, throws "vector out of range". The `std::stoull()` calls on those tokens throw on any non numeric value.
3. `getRtpEncodings()` iterates ssrcs unguarded.
```c++
for (const auto& line : offerMediaObject["ssrcs"])Same pattern as #192, on a const json&. The MSC_THROW_ERROR("no a=ssrc lines found") meant to cover this case sits after the loop.
addLegacySimulcast()does not check semantics is FID.
The loop at line 314 only checks that semantics is a string, so an a=ssrc-group:SIM ... line also matches and its second SSRC is taken as the RTX one.
getCname()does not check the attribute is cname.
The predicate accepts any a=ssrc line having a string attribute. mediasoup-clientcompares it with 'cname'. It works today only because libwebrtc emits the cname line first.
Utils::IsInt() and Utils::ToInt() already exist in include/Utils.hpp but are not used in any of these places.
Activity