Skip to content
Permalink
Browse files
Allow zero payload packets to pass bounds check.
  • Loading branch information
jfigus committed Nov 20, 2015
1 parent cdc69f2 commit be06686c8e98cc7bd934e10abb6f5e971d03f8ee
Showing with 2 additions and 2 deletions.
  1. +2 −2 srtp/srtp.c
@@ -950,7 +950,7 @@ srtp_protect_aead (srtp_ctx_t *ctx, srtp_stream_ctx_t *stream,
srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t*)enc_start;
enc_start += (ntohs(xtn_hdr->length) + 1);
}
if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
if (!((uint8_t*)enc_start <= (uint8_t*)hdr + *pkt_octet_len))
return err_status_parse_err;
enc_octet_len = (int)(*pkt_octet_len -
((uint8_t*)enc_start - (uint8_t*)hdr));
@@ -1308,7 +1308,7 @@ srtp_unprotect_aead (srtp_ctx_t *ctx, srtp_stream_ctx_t *stream, int delta,
srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t *)enc_start;
enc_start += (ntohs(xtn_hdr->length) + 1);
}
if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
if (!((uint8_t*)enc_start <= (uint8_t*)hdr + *pkt_octet_len))
return err_status_parse_err;
enc_octet_len = (int)(*pkt_octet_len -
((uint8_t*)enc_start - (uint8_t*)hdr));

0 comments on commit be06686

Please sign in to comment.