From 0febae7443b165ceaa69641e95d7069f26719e59 Mon Sep 17 00:00:00 2001 From: Pascal Buhler Date: Wed, 12 Oct 2011 11:28:10 +0200 Subject: [PATCH] rtcpbuffer: prevent overflow of 16bit header length. RTCP header can be (2^16 + 1) * 4 bytes long, so when validating a bogus packet it was possible to get a 16bit overflow resulting in a length of 0. This would put the gst_rtcp_buffer_validate_data function in a endless loop. https://bugzilla.gnome.org/show_bug.cgi?id=667313 --- gst-libs/gst/rtp/gstrtcpbuffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gst-libs/gst/rtp/gstrtcpbuffer.c b/gst-libs/gst/rtp/gstrtcpbuffer.c index fbd928c..539f763 100644 --- a/gst-libs/gst/rtp/gstrtcpbuffer.c +++ b/gst-libs/gst/rtp/gstrtcpbuffer.c @@ -111,7 +111,7 @@ gboolean gst_rtcp_buffer_validate_data (guint8 * data, guint len) { guint16 header_mask; - guint16 header_len; + guint header_len; guint8 version; guint data_len; gboolean padding; -- 2.7.4