WebRTC: Overflow in FEC Processing

The pref 'media.navigator.video.red_ulpfec_enabled' is disabled by default in Firefox. I did enable it now for Domino fuzzing runs.

From bug 1480173 comment #1: Project Zero found a problem in processing RED packets: https://bugs.chromium.org/p/project-zero/issues/detail?id=1573 By default RED support is preffed off in Firefox. As the Chrome bug is again not public yet going from the stack trace in the Project Zero report it looks like Firefox is affected: https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc#173 Because the buffer size is fixed to 1500 bytes: https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/forward_error_correction.h#42 https://searchfox.org/mozilla-central/rev/196560b95f191b48ff7cba7c2ba9237bba6b5b6a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/include/rtp_rtcp_defines.h#24

this is chrome bug https://bugs.chromium.org/p/chromium/issues/detail?id=841962 The patch appears to be https://webrtc.googlesource.com/src.git/+/7a84fcf47a492d17ca20947e65b21a06b28e77cd

If this is disabled in Firefox can we unhide the bug? Or were we planning on enabling some time soon?

No we are not planing on enabling it soon. So if it's okay to disclose preffed off issues, then we should be able to disclose this one.

I'll make it block the bug to enable fec.

Pushed by nohlmeier@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/cc5e3d514f28 Added length check for uplfec. r=dminor