Crash while decompressing RTP stream with large TS jump and UOR-2 disambiguation
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
rohc | Status tracked in Rohc-main | |||||
1.3.x |
Invalid
|
Undecided
|
Didier Barvaux | |||
1.4.x |
Invalid
|
Undecided
|
Didier Barvaux | |||
Rohc-1.5.x |
Fix Released
|
High
|
Didier Barvaux | |||
Rohc-main |
Fix Released
|
High
|
Didier Barvaux |
Bug Description
While testing the library on a lossy network, the attached stream crashed the decompressor (assert). The stream is one RTP stream with a random IP-ID (RND=1) and regular TS, then one RTP packet causes IP-ID to be non-random (RND=0) and a large TS jump.
One UOR-2-TS packet with extension 3 is chosen to transmit more than many TS bits. Because of the RND change, the decompressor tries to parse the UOR-2-TS packet as UOR-2-RTP. It parses 6 bits of TS from the packet (instead of 5 bits if UOR-2-TS was recognized) and 29 bits of TS in extension 3. The packet contains more than 32 bits of TS, so the MSB must be set to 0. It is not the case because UOR-2 disambiguation selected UOR-2-RTP because RND=1 in context.
Solution: Do not assert if superfluous bits are not set to 0 because it can just happen. Just emit a warning.
Fixed in main branch. See http:// bazaar. launchpad. net/~didier- barvaux/ rohc/main/ revision/ 605