Changeset 5919

Timestamp:

Dec 4, 2018 2:25:52 AM (5 years ago)

Author:

ming

Message:

Fixed #2166: Possible buffer overread if RTCP packet length is invalid

File:

• pjproject/trunk/pjmedia/src/pjmedia/rtcp.c (modified) (1 diff)

pjproject/trunk/pjmedia/src/pjmedia/rtcp.c

@@ -824 +824 @@
 
         len = (pj_ntohs((pj_uint16_t)common->length)+1) * 4;
+        if (p + len > p_end)
+            break;
+
         switch(common->pt) {
         case RTCP_SR: