diff --git a/srtp/srtp.c b/srtp/srtp.c index 3f940f078..0da345cab 100644 --- a/srtp/srtp.c +++ b/srtp/srtp.c @@ -950,7 +950,7 @@ srtp_protect_aead (srtp_ctx_t *ctx, srtp_stream_ctx_t *stream, srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t*)enc_start; enc_start += (ntohs(xtn_hdr->length) + 1); } - if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len)) + if (!((uint8_t*)enc_start <= (uint8_t*)hdr + *pkt_octet_len)) return err_status_parse_err; enc_octet_len = (int)(*pkt_octet_len - ((uint8_t*)enc_start - (uint8_t*)hdr)); @@ -1308,7 +1308,7 @@ srtp_unprotect_aead (srtp_ctx_t *ctx, srtp_stream_ctx_t *stream, int delta, srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t *)enc_start; enc_start += (ntohs(xtn_hdr->length) + 1); } - if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len)) + if (!((uint8_t*)enc_start <= (uint8_t*)hdr + *pkt_octet_len)) return err_status_parse_err; enc_octet_len = (int)(*pkt_octet_len - ((uint8_t*)enc_start - (uint8_t*)hdr));