stv0g/re
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

patch: check length of RTCP FB messages

Browse source
This commit is contained in:
Alfred E. Heggestad 2013-10-23 13:43:44 +00:00
parent 570bb426f2
commit 20a43ff3c3
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/rtp/pkt.c
View file

@ -412,6 +412,10 @@ int rtcp_decode(struct rtcp_msg **msgp, struct mbuf *mb)
case RTCP_RTPFB:
if (mbuf_get_left(mb) < RTCP_FB_SIZE)
goto badmsg;
if (msg->hdr.length < 2)
goto badmsg;
msg->r.fb.ssrc_packet = ntohl(mbuf_read_u32(mb));
msg->r.fb.ssrc_media = ntohl(mbuf_read_u32(mb));
msg->r.fb.n = msg->hdr.length - 2;
@ -422,6 +426,10 @@ int rtcp_decode(struct rtcp_msg **msgp, struct mbuf *mb)
case RTCP_PSFB:
if (mbuf_get_left(mb) < RTCP_FB_SIZE)
goto badmsg;
if (msg->hdr.length < 2)
goto badmsg;
msg->r.fb.ssrc_packet = ntohl(mbuf_read_u32(mb));
msg->r.fb.ssrc_media = ntohl(mbuf_read_u32(mb));
msg->r.fb.n = msg->hdr.length - 2;