decompressor crash with truncated UOR-2 packets of the RTP profile
Bug #1181829 reported by
Didier Barvaux
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | ||
|---|---|---|---|---|---|---|
| rohc | Status tracked in Rohc-main | |||||
| 1.3.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
| 1.4.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
| Rohc-1.5.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
| Rohc-main |
Fix Released
|
Critical
|
Didier Barvaux | |||
Bug Description
The UOR-2 packets of the RTP profile got an additional 1-byte field wrt the non-RTP UOR-2 packet. The minimal length of the UOR-2 packets is checked, but the additional byte is not taken into account. So a truncated UOR-2 packet can crash or assert the decompressor.
Revision history for this message
| Didier Barvaux (didier-barvaux) wrote | #1 |
| no longer affects: | rohc/iprohc |
Revision history for this message
| Didier Barvaux (didier-barvaux) wrote | #2 |
Revision history for this message
| Didier Barvaux (didier-barvaux) wrote | #3 |
Revision history for this message
| Didier Barvaux (didier-barvaux) wrote | #4 |
Revision history for this message
| Didier Barvaux (didier-barvaux) wrote | #5 |
To post a comment you must log in.
Fixed in main branch. See http://