message: Add more VP9 header correctness check in RtpFrameReferenceFinder
  Cr-Commit-Position: refs/heads/master@{#30466}
diff: @@ -435,7 +435,8 @@ RtpFrameReferenceFinder::FrameDecision RtpFrameReferenceFinder::ManageFrameVp9(
  }
  // Protect against corrupted packets with arbitrary large temporal idx.
  - if (codec_header.temporal_idx >= kMaxTemporalLayers)
  + if (codec_header.temporal_idx >= kMaxTemporalLayers ||
  + codec_header.spatial_idx >= kMaxSpatialLayers)
  return kDrop;
  frame->id.spatial_layer = codec_header.spatial_idx;
  @@ -477,6 +478,12 @@ RtpFrameReferenceFinder::FrameDecision RtpFrameReferenceFinder::ManageFrameVp9(
  return kDrop;
  }
  + for (size_t i = 0; i < codec_header.gof.num_frames_in_gof; ++i) {
  + if (codec_header.gof.num_ref_pics[i] > kMaxVp9RefPics) {
  + return kDrop;
  + }
  + }
  +
  GofInfoVP9 gof = codec_header.gof;
  if (gof.num_frames_in_gof == 0) {
  RTC_LOG(LS_WARNING) << "Number of frames in GOF is zero. Assume "
  