From 6a9bd744811c183764ef4a590aacbf96f18eb57e Mon Sep 17 00:00:00 2001
From: Ying Wang <yinwa@webrtc.org>
Date: Fri, 15 Jun 2018 14:54:16 +0200
Subject: [PATCH] Fix a downstream test failure.

In rare case the packets number may loop around and in the same FEC-protected group the packet sequence number became out of order.

Bug: chromium:850493
Change-Id: Ice82aafd537e0edc1dbdb8b934e11e7c42a4cf60
Reviewed-on: https://webrtc-review.googlesource.com/82802
Commit-Queue: Ying Wang <yinwa@webrtc.org>
Reviewed-by: Henrik Lundin <henrik.lundin@webrtc.org>
Reviewed-by: Rasmus Brandt <brandtr@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23633}
---
 .../source/forward_error_correction_internal.cc     |  2 ++
 test/fuzzers/ulpfec_generator_fuzzer.cc             | 13 ++++++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/modules/rtp_rtcp/source/forward_error_correction_internal.cc b/modules/rtp_rtcp/source/forward_error_correction_internal.cc
index 7336331b49..7e5fd91e03 100644
--- a/modules/rtp_rtcp/source/forward_error_correction_internal.cc
+++ b/modules/rtp_rtcp/source/forward_error_correction_internal.cc
@@ -498,6 +498,8 @@ void CopyColumn(uint8_t* new_mask,
                 int num_fec_packets,
                 int new_bit_index,
                 int old_bit_index) {
+  RTC_CHECK_LT(new_bit_index, 8 * new_mask_bytes);
+
   // Copy column from the old mask to the beginning of the new mask and shift it
   // out from the old mask.
   for (uint16_t row = 0; row < num_fec_packets; ++row) {
diff --git a/test/fuzzers/ulpfec_generator_fuzzer.cc b/test/fuzzers/ulpfec_generator_fuzzer.cc
index 995bf290b3..ba9a53af58 100644
--- a/test/fuzzers/ulpfec_generator_fuzzer.cc
+++ b/test/fuzzers/ulpfec_generator_fuzzer.cc
@@ -31,7 +31,7 @@ void FuzzOneInput(const uint8_t* data, size_t size) {
       data[i++] % 128, static_cast<int>(data[i++] % 10), kFecMaskBursty};
   generator.SetFecParameters(params);
   uint16_t seq_num = data[i++];
-
+  uint16_t prev_seq_num = 0;
   while (i + 3 < size) {
     size_t rtp_header_length = data[i++] % 10 + 12;
     size_t payload_size = data[i++] % 10;
@@ -40,13 +40,20 @@ void FuzzOneInput(const uint8_t* data, size_t size) {
     std::unique_ptr<uint8_t[]> packet(
         new uint8_t[payload_size + rtp_header_length]);
     memcpy(packet.get(), &data[i], payload_size + rtp_header_length);
+
+    // Make sure sequence numbers are increasing.
     ByteWriter<uint16_t>::WriteBigEndian(&packet[2], seq_num++);
     i += payload_size + rtp_header_length;
-    // Make sure sequence numbers are increasing.
     const bool protect = data[i++] % 2 == 1;
-    if (protect) {
+
+    // Check the sequence numbers are monotonic. In rare case the packets number
+    // may loop around and in the same FEC-protected group the packet sequence
+    // number became out of order.
+    if (protect && static_cast<uint16_t>(seq_num - prev_seq_num) <
+                       kUlpfecMaxMediaPackets) {
       generator.AddRtpPacketAndGenerateFec(packet.get(), payload_size,
                                            rtp_header_length);
+      prev_seq_num = seq_num;
     }
     const size_t num_fec_packets = generator.NumAvailableFecPackets();
     if (num_fec_packets > 0) {