From f52e0152397cda785ff311394d8275f210bd5a20 Mon Sep 17 00:00:00 2001
From: Danil Chapovalov <danilchap@webrtc.org>
Date: Fri, 23 Dec 2022 14:17:02 +0000
Subject: [PATCH] Zero extra bytes of FEC recovered packet

rtc::CopyOnWriteBuffer::SetSize extends buffer with uninitialized memory by design.
It is up to the user of the rtc::CopyOnWriteBuffer to ensure it is initialized.

Bug: chromium:1403397
Change-Id: Ic0111a84bda32379770ddb1c7d24bee10d96b7a4
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/289041
Reviewed-by: Rasmus Brandt <brandtr@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#38959}
---
 modules/rtp_rtcp/source/forward_error_correction.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/rtp_rtcp/source/forward_error_correction.cc b/modules/rtp_rtcp/source/forward_error_correction.cc
index 903d3e7d45..dbf6c361df 100644
--- a/modules/rtp_rtcp/source/forward_error_correction.cc
+++ b/modules/rtp_rtcp/source/forward_error_correction.cc
@@ -573,7 +573,13 @@ bool ForwardErrorCorrection::FinishPacketRecovery(
                            "typical IP packet, and is thus dropped.";
     return false;
   }
+  size_t old_size = recovered_packet->pkt->data.size();
   recovered_packet->pkt->data.SetSize(new_size);
+  data = recovered_packet->pkt->data.MutableData();
+  if (new_size > old_size) {
+    memset(data + old_size, 0, new_size - old_size);
+  }
+
   // Set the SN field.
   ByteWriter<uint16_t>::WriteBigEndian(&data[2], recovered_packet->seq_num);
   // Set the SSRC field.