Skip to content

Commit 22af44e

Browse files
authored
Merge pull request from GHSA-m66q-q64c-hv36
* Prevent OOB read during RTP/RTCP parsing * Add log * Add more logs
1 parent a5e052f commit 22af44e

File tree

3 files changed

+27
-4
lines changed

3 files changed

+27
-4
lines changed

Diff for: pjmedia/src/pjmedia/rtcp.c

+20-2
Original file line numberDiff line numberDiff line change
@@ -502,12 +502,22 @@ static void parse_rtcp_report( pjmedia_rtcp_session *sess,
502502

503503
/* Parse RTCP */
504504
if (common->pt == RTCP_SR) {
505+
if (sizeof (pjmedia_rtcp_common) + sizeof (pjmedia_rtcp_sr) > size) {
506+
TRACE_((sess->name, "Discarding RTCP SR due to truncated size "
507+
"%d bytes", size));
508+
return;
509+
}
505510
sr = (pjmedia_rtcp_sr*) (((char*)pkt) + sizeof(pjmedia_rtcp_common));
506511
if (common->count > 0 && size >= (sizeof(pjmedia_rtcp_sr_pkt))) {
507512
rr = (pjmedia_rtcp_rr*)(((char*)pkt) + (sizeof(pjmedia_rtcp_common)
508513
+ sizeof(pjmedia_rtcp_sr)));
509514
}
510515
} else if (common->pt == RTCP_RR && common->count > 0) {
516+
if (sizeof (pjmedia_rtcp_common) + sizeof (pjmedia_rtcp_rr) > size) {
517+
TRACE_((sess->name, "Discarding RTCP RR due to truncated size "
518+
"%d bytes", size));
519+
return;
520+
}
511521
rr = (pjmedia_rtcp_rr*)(((char*)pkt) + sizeof(pjmedia_rtcp_common));
512522
#if defined(PJMEDIA_HAS_RTCP_XR) && (PJMEDIA_HAS_RTCP_XR != 0)
513523
} else if (common->pt == RTCP_XR) {
@@ -826,12 +836,20 @@ PJ_DEF(void) pjmedia_rtcp_rx_rtcp( pjmedia_rtcp_session *sess,
826836
p = (pj_uint8_t*)pkt;
827837
p_end = p + size;
828838
while (p < p_end) {
829-
pjmedia_rtcp_common *common = (pjmedia_rtcp_common*)p;
839+
pjmedia_rtcp_common *common;
830840
unsigned len;
831841

842+
if (p + sizeof(pjmedia_rtcp_common) > p_end) {
843+
TRACE_((sess->name, "Receiving truncated RTCP packet (1)"));
844+
break;
845+
}
846+
common = (pjmedia_rtcp_common*)p;
847+
832848
len = (pj_ntohs((pj_uint16_t)common->length)+1) * 4;
833-
if (p + len > p_end)
849+
if (p + len > p_end) {
850+
TRACE_((sess->name, "Receiving truncated RTCP packet (2)"));
834851
break;
852+
}
835853

836854
switch(common->pt) {
837855
case RTCP_SR:

Diff for: pjmedia/src/pjmedia/rtcp_fb.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -631,7 +631,8 @@ PJ_DEF(pj_status_t) pjmedia_rtcp_fb_parse_nack(
631631
if (hdr->pt != RTCP_RTPFB || hdr->count != 1)
632632
return PJ_ENOTFOUND;
633633

634-
cnt = pj_ntohs((pj_uint16_t)hdr->length) - 2;
634+
cnt = pj_ntohs((pj_uint16_t)hdr->length);
635+
if (cnt > 2) cnt -= 2; else cnt = 0;
635636
if (length < (cnt+3)*4)
636637
return PJ_ETOOSMALL;
637638

@@ -663,7 +664,9 @@ PJ_DEF(pj_status_t) pjmedia_rtcp_fb_parse_pli(
663664
pjmedia_rtcp_common *hdr = (pjmedia_rtcp_common*) buf;
664665

665666
PJ_ASSERT_RETURN(buf, PJ_EINVAL);
666-
PJ_ASSERT_RETURN(length >= 12, PJ_ETOOSMALL);
667+
668+
if (length < 12)
669+
return PJ_ETOOSMALL;
667670

668671
/* PLI uses pt==RTCP_PSFB and FMT==1 */
669672
if (hdr->pt != RTCP_PSFB || hdr->count != 1)

Diff for: pjmedia/src/pjmedia/rtp.c

+2
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,8 @@ PJ_DEF(pj_status_t) pjmedia_rtp_decode_rtp2(
190190

191191
/* Decode RTP extension. */
192192
if ((*hdr)->x) {
193+
if (offset + sizeof (pjmedia_rtp_ext_hdr) > pkt_len)
194+
return PJMEDIA_RTP_EINLEN;
193195
dec_hdr->ext_hdr = (pjmedia_rtp_ext_hdr*)(((pj_uint8_t*)pkt) + offset);
194196
dec_hdr->ext = (pj_uint32_t*)(dec_hdr->ext_hdr + 1);
195197
dec_hdr->ext_len = pj_ntohs((dec_hdr->ext_hdr)->length);

0 commit comments

Comments
 (0)