#2035 closed defect (fixed)
Make sure transport SRTP buf size is sufficient before calling srtp_protect() and srtp_protect_rtcp()
Reported by: | riza | Owned by: | nanang |
---|---|---|---|
Priority: | normal | Milestone: | release-2.7 |
Component: | pjmedia | Version: | trunk |
Keywords: | Cc: | ||
Backport to 1.x milestone: | Backported: | no |
Description
From srtp doc (srtp.h)
/** * SRTP_MAX_TRAILER_LEN is the maximum length of the SRTP trailer * (authentication tag and MKI) supported by libSRTP. This value is * the maixmum number of octets that will be added to an RTP packet by * srtp_protect(). * * @brief the maximum number of octets added by srtp_protect(). */ #define SRTP_MAX_TRAILER_LEN (SRTP_MAX_TAG_LEN + SRTP_MAX_MKI_LEN)
... * @warning This function assumes that it can write SRTP_MAX_TRAILER_LEN * into the location in memory immediately following the RTP packet. * Callers MUST ensure that this much writable memory is available in * the buffer that holds the RTP packet. ... srtp_err_status_t srtp_protect(srtp_t ctx, void *rtp_hdr, int *len_ptr);
Currently, transport SRTP use hardcoded value to check if the space is sufficient.
This ticket will use SRTP_MAX_TRAILER_LEN instead to check the required buffer space.
Thanks to Chris Panayis for the report.
Change History (3)
comment:1 Changed 7 years ago by riza
- Resolution set to fixed
- Status changed from new to closed
comment:2 Changed 7 years ago by riza
In 5640:
comment:3 Changed 7 years ago by riza
In 5643:
Note: See
TracTickets for help on using
tickets.
In 5639: