rohc

decompressor: compressed list with 8-bit XI fields (PS=1) cause a crash

Bug #1087683 reported by Didier Barvaux on 2012-12-07

6

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	rohc	Status tracked in Rohc-main
	1.3.x	Fix Released	High	Didier Barvaux	rohc 1.3.4
	1.4.x	Fix Released	Critical	Didier Barvaux	rohc 1.4.2
	Rohc-1.5.x	Fix Released	Critical	Didier Barvaux	rohc 1.5.1
	Rohc-main	Fix Released	Critical	Didier Barvaux	rohc 1.6.0

Bug Description

Decompressing a ROHC packet with a compressed list that uses 8-bit XI fields (PS=1) makes the ROHC library crash.

Tags:

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#1

Fixed in main branch: use the GET_REAL() macro on the PS bit extracted from the ROHC packet before using it as a 0-1 flag.

See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/616

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#2

Will not crash on 1.3.x, but better fix packet parsing anyway.

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#3

Fixed on 1.5.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/537

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#4

Fixed on 1.4.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/353

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#5

Fixed on 1.3.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.3.x/revision/206

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.