Out-of-bounds buffer access avoided

Bug: 258716151
Test: atest ImsMediaNativeTests
Change-Id: Ibf13cc3973e85d8fef7450f1e019c80c407be09c

5 files changed, 33 insertions, 26 deletions

diff --git a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpFbPacketTest.cpp b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpFbPacketTest.cpp
index d222f55a..5dd2968e 100644
--- a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpFbPacketTest.cpp
+++ b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpFbPacketTest.cpp
@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-#include <RtpTrace.h>
 #include <RtcpFbPacket.h>
 #include <gtest/gtest.h>
 
@@ -34,11 +33,12 @@ TEST(RtcpFbPacketTest, TestGetSetMethods)
     objRtcpFbPacket.setMediaSsrc(0xAAAAAAAA);
     EXPECT_EQ(objRtcpFbPacket.getMediaSsrc(), 0xAAAAAAAA);
 
-    uint8_t testFCI[] = {0xe6, 0x5f, 0xa5, 0x31};
-    objRtcpFbPacket.setFCI(new RtpBuffer(4, testFCI));
+    uint8_t testFci[] = {0xe6, 0x5f, 0xa5, 0x31};
+    objRtcpFbPacket.setFCI(new RtpBuffer(sizeof(testFci), testFci));
     RtpBuffer* pRtpBuf = objRtcpFbPacket.getFCI();
+
     ASSERT_TRUE(pRtpBuf != NULL);
-    EXPECT_EQ(memcmp(pRtpBuf->getBuffer(), testFCI, 4), 0);
+    EXPECT_EQ(memcmp(pRtpBuf->getBuffer(), testFci, sizeof(testFci)), 0);
 
     objRtcpFbPacket.setPayloadType(RTCP_RTPFB);
     EXPECT_EQ(objRtcpFbPacket.getPayloadType(), RTCP_RTPFB);
@@ -53,12 +53,15 @@ TEST(RtcpFbPacketTest, TestDecodeFbPacket)
     uint8_t bufPacket[] = {0xb1, 0xc8, 0xcb, 0x03, 0x54, 0x4d, 0x4d, 0x42, 0x52, 0x2a, 0x2a, 0x2a};
 
     RtcpFbPacket objRtcpFbPacket;
-    eRTP_STATUS_CODE res = objRtcpFbPacket.decodeRtcpFbPacket((RtpDt_UChar*)bufPacket, 12);
+    eRTP_STATUS_CODE res =
+            objRtcpFbPacket.decodeRtcpFbPacket((RtpDt_UChar*)bufPacket, sizeof(bufPacket));
     EXPECT_EQ(res, RTP_SUCCESS);
     EXPECT_EQ(objRtcpFbPacket.getMediaSsrc(), 0xb1c8cb03);
     RtpBuffer* pRtpBuf = objRtcpFbPacket.getFCI();
     ASSERT_TRUE(pRtpBuf != NULL);
-    EXPECT_EQ(memcmp(pRtpBuf->getBuffer(), (bufPacket + 4), 8), 0);
+    EXPECT_EQ(memcmp(pRtpBuf->getBuffer(), (bufPacket + RTP_WORD_SIZE),
+                      (sizeof(bufPacket) - RTP_WORD_SIZE)),
+            0);
 }
 
 TEST(RtcpFbPacketTest, TestEncodeRtcpRTPFB)
@@ -77,8 +80,8 @@ TEST(RtcpFbPacketTest, TestEncodeRtcpRTPFB)
     objRtcpFbPacket.setMediaSsrc(0xAAAAAAAA);
     objRtcpFbPacket.setPayloadType(RTCP_RTPFB);
 
-    uint8_t testFCI[] = {0xe6, 0x5f, 0xa5, 0x31};
-    objRtcpFbPacket.setFCI(new RtpBuffer(4, testFCI));
+    uint8_t testFci[] = {0xe6, 0x5f, 0xa5, 0x31};
+    objRtcpFbPacket.setFCI(new RtpBuffer(sizeof(testFci), testFci));
 
     eRTP_STATUS_CODE res = objRtcpFbPacket.formRtcpFbPacket(&objRtcpPktBuf);
     EXPECT_EQ(res, RTP_SUCCESS);
@@ -86,5 +89,6 @@ TEST(RtcpFbPacketTest, TestEncodeRtcpRTPFB)
     RtpDt_UChar* buf = objRtcpPktBuf.getBuffer();
     RtpDt_UChar expectedBuf[] = {0x81, 0xcd, 0x00, 0x03, 0x01, 0x02, 0x03, 0x04, 0xaa, 0xaa, 0xaa,
             0xaa, 0xe6, 0x5f, 0xa5, 0x31};
-    EXPECT_EQ(memcmp(buf, expectedBuf, 16), 0);
+
+    EXPECT_EQ(memcmp(buf, expectedBuf, sizeof(expectedBuf)), 0);
 }
\ No newline at end of file
diff --git a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpHeaderTest.cpp b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpHeaderTest.cpp
index 2fef7b85..d783751c 100644
--- a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpHeaderTest.cpp
+++ b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpHeaderTest.cpp
@@ -152,7 +152,8 @@ TEST_F(RtcpHeaderTest, TestFormRtcpHeader)
     rtpBuffer.setLength(0);
     rtcpHeader.formRtcpHeader(&rtpBuffer);
 
-    RtpDt_UChar bExpectedRTCPBuff[] = {0xA5, 0xc8, 0x00, 0x06, 0xFF, 0xFF, 0xFF, 0xFF};
-    EXPECT_EQ(rtpBuffer.getLength(), 8);
-    EXPECT_EQ(memcmp(rtpBuffer.getBuffer(), bExpectedRTCPBuff, 8), 0);
+    RtpDt_UChar bExpectedRtcpBuff[] = {0xA5, 0xc8, 0x00, 0x06, 0xFF, 0xFF, 0xFF, 0xFF};
+
+    EXPECT_EQ(rtpBuffer.getLength(), sizeof(bExpectedRtcpBuff));
+    EXPECT_EQ(memcmp(rtpBuffer.getBuffer(), bExpectedRtcpBuff, sizeof(bExpectedRtcpBuff)), 0);
 }
\ No newline at end of file
diff --git a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpReportBlockTest.cpp b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpReportBlockTest.cpp
index ecec7f54..4f1b3be8 100644
--- a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpReportBlockTest.cpp
+++ b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpReportBlockTest.cpp
@@ -78,5 +78,5 @@ TEST(RtcpReportBlockTest, TestFormReportBlock)
     uint8_t bufReportBlock[] = {0x86, 0xd4, 0xe6, 0xe9, 0xFF, 0xAA, 0xBB, 0xCC, 0x11, 0x22, 0x33,
             0x44, 0x01, 0x02, 0x03, 0x04, 0x86, 0xd4, 0xe6, 0x00, 0x86, 0xd4, 0xe6, 0x01};
 
-    EXPECT_EQ(memcmp(bufReportBlock, objRtcpPktBuf.getBuffer(), 24), 0);
+    EXPECT_EQ(memcmp(bufReportBlock, objRtcpPktBuf.getBuffer(), sizeof(bufReportBlock)), 0);
 }
\ No newline at end of file
diff --git a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpXrPacketTest.cpp b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpXrPacketTest.cpp
index 8d9b5115..0c880a27 100644
--- a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpXrPacketTest.cpp
+++ b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtcpXrPacketTest.cpp
@@ -36,12 +36,14 @@ TEST(RtcpXrPacketTest, TestGetSetMethods)
     EXPECT_EQ(objRtcpXrPacket.getRttdOffset(), 0xAAAA);
 
     uint8_t testReport[] = {0xe6, 0x5f, 0xa5, 0x31, 0x53, 0x91, 0x24, 0xc2, 0x00, 0x04, 0x01};
-    RtpBuffer* pTestReportBuf = new RtpBuffer(11, testReport);
+
+    RtpBuffer* pTestReportBuf = new RtpBuffer(sizeof(testReport), testReport);
     objRtcpXrPacket.setReportBlk(pTestReportBuf);
     RtpBuffer* pRetReportBuf = objRtcpXrPacket.getReportBlk();
     ASSERT_TRUE(pRetReportBuf != NULL);
-    EXPECT_EQ(memcmp(pTestReportBuf->getBuffer(), pRetReportBuf->getBuffer(), 11), 0);
-    EXPECT_EQ(pRetReportBuf->getLength(), 11);
+    EXPECT_EQ(
+            memcmp(pTestReportBuf->getBuffer(), pRetReportBuf->getBuffer(), sizeof(testReport)), 0);
+    EXPECT_EQ(pRetReportBuf->getLength(), sizeof(testReport));
 }
 
 TEST(RtcpXrPacketTest, TestDecodeXrPacket)
@@ -70,7 +72,7 @@ TEST(RtcpXrPacketTest, TestFormXrPacket)
     objRtcpXrPacket.setRtcpHdrInfo(header);
 
     uint8_t testReport[] = {0xe6, 0x5f, 0xa5, 0x31};
-    RtpBuffer* pTestReportBuf = new RtpBuffer(4, testReport);
+    RtpBuffer* pTestReportBuf = new RtpBuffer(sizeof(testReport), testReport);
     objRtcpXrPacket.setReportBlk(pTestReportBuf);
 
     eRTP_STATUS_CODE res = objRtcpXrPacket.formRtcpXrPacket(&objRtcpPktBuf);
@@ -80,5 +82,6 @@ TEST(RtcpXrPacketTest, TestFormXrPacket)
     ASSERT_TRUE(buf != NULL);
     RtpDt_UChar expectedBuf[] = {
             0X81, 0XCF, 0X00, 0X02, 0X01, 0X02, 0X03, 0X04, 0XE6, 0X5F, 0XA5, 0X31};
-    EXPECT_EQ(memcmp(buf, expectedBuf, 12), 0);
+
+    EXPECT_EQ(memcmp(buf, expectedBuf, sizeof(expectedBuf)), 0);
 }
\ No newline at end of file
diff --git a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtpPacketTest.cpp b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtpPacketTest.cpp
index d2b6fbb2..cc725024 100644
--- a/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtpPacketTest.cpp
+++ b/tests/native/service/src/com/android/telephony/imsmedia/lib/libimsmedia/protocol/rtp/core/RtpPacketTest.cpp
@@ -83,7 +83,7 @@ TEST(RtpPacketTest, TestDecodePacket)
             0x02, 0xbe, 0xde, 0x00, 0x01, 0x41, 0x78, 0x42, 0x00, 0x67, 0x42, 0xc0, 0x0c, 0xda,
             0x0f, 0x0a, 0x69, 0xa8, 0x10, 0x10, 0x10, 0x3c, 0x58, 0xba, 0x80};
 
-    RtpBuffer rtpBuffer(sizeof(pobjRtpPktBuf) / sizeof(pobjRtpPktBuf[0]), pobjRtpPktBuf);
+    RtpBuffer rtpBuffer(sizeof(pobjRtpPktBuf), pobjRtpPktBuf);
     eRtp_Bool eResult = rtpPacket.decodePacket(&rtpBuffer);
 
     EXPECT_EQ(eResult, eRTP_SUCCESS);
@@ -91,21 +91,20 @@ TEST(RtpPacketTest, TestDecodePacket)
     // check Header extension
     RtpBuffer* pobjRtpExtHdr = rtpPacket.getExtHeader();
     ASSERT_TRUE(pobjRtpExtHdr != NULL);
-    uint8_t pRtpExtHdr[] = {0x41, 0x78, 0x42};
 
-    EXPECT_TRUE(pobjRtpExtHdr != NULL);
-    EXPECT_EQ(memcmp(pRtpExtHdr, pobjRtpExtHdr->getBuffer(), 4), 0);
-    EXPECT_EQ(pobjRtpExtHdr->getLength(), 4);
+    uint8_t pRtpExtHdr[] = {0x41, 0x78, 0x42, 0x00};
+
+    EXPECT_EQ(memcmp(pRtpExtHdr, pobjRtpExtHdr->getBuffer(), sizeof(pRtpExtHdr)), 0);
+    EXPECT_EQ(pobjRtpExtHdr->getLength(), sizeof(pRtpExtHdr));
 
     // check Payload
     RtpBuffer* pobjRtpBuffer = rtpPacket.getRtpPayload();
     uint8_t pRtpPayLoad[] = {0x67, 0x42, 0xc0, 0x0c, 0xda, 0x0f, 0x0a, 0x69, 0xa8, 0x10, 0x10, 0x10,
             0x3c, 0x58, 0xba, 0x80};
-    const RtpDt_UInt32 uiLength = sizeof(pRtpPayLoad) / sizeof(pRtpPayLoad[0]);
 
     ASSERT_TRUE(pobjRtpBuffer != NULL);
-    EXPECT_EQ(memcmp(pRtpPayLoad, pobjRtpBuffer->getBuffer(), uiLength), 0);
-    EXPECT_EQ(pobjRtpBuffer->getLength(), uiLength);
+    EXPECT_EQ(memcmp(pRtpPayLoad, pobjRtpBuffer->getBuffer(), sizeof(pRtpPayLoad)), 0);
+    EXPECT_EQ(pobjRtpBuffer->getLength(), sizeof(pRtpPayLoad));
 }
 
 TEST(RtpPacketTest, TestDecodePacketWithWrongRtpVersion)