Fail RTP parsing on excessive padding length.

webrtc/modules/rtp_rtcp/source/rtp_payload_registry.cc

 /*
  *  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 219 matching lines @@
 
 bool RTPPayloadRegistry::IsRtxInternal(const RTPHeader& header) const {
   return rtx_ && ssrc_rtx_ == header.ssrc;
 }
 
 bool RTPPayloadRegistry::RestoreOriginalPacket(uint8_t** restored_packet,
                                                const uint8_t* packet,
                                                size_t* packet_length,
                                                uint32_t original_ssrc,
                                                const RTPHeader& header) const {
-  if (kRtxHeaderSize + header.headerLength > *packet_length) {
+  if (kRtxHeaderSize + header.headerLength + header.paddingLength >
+      *packet_length) {
     return false;
   }
   const uint8_t* rtx_header = packet + header.headerLength;
   uint16_t original_sequence_number = (rtx_header[0] << 8) + rtx_header[1];
 
   // Copy the packet into the restored packet, except for the RTX header.
   memcpy(*restored_packet, packet, header.headerLength);
   memcpy(*restored_packet + header.headerLength,
          packet + header.headerLength + kRtxHeaderSize,
          *packet_length - header.headerLength - kRtxHeaderSize);
@@ skipping 209 matching lines @@
 RTPPayloadStrategy* RTPPayloadStrategy::CreateStrategy(
     const bool handling_audio) {
   if (handling_audio) {
     return new RTPPayloadAudioStrategy();
   } else {
     return new RTPPayloadVideoStrategy();
   }
 }
 
 }  // namespace webrtc