rohc

Malformed uncompressed packets may crash the ROHC compressor

Bug #1105935 reported by Didier Barvaux
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rohc
Status tracked in Rohc-main
1.3.x
Fix Released
Critical
Didier Barvaux
rohc 1.3.5
1.4.x
Fix Released
Critical
Didier Barvaux
rohc 1.4.3
Rohc-1.5.x
Fix Released
Critical
Didier Barvaux
rohc 1.5.2
Rohc-main
Fix Released
Critical
Didier Barvaux
rohc 1.6.0

Bug Description

If some malformed (too short) IPv4, IPv6, IP/UDP, and IP/UDP/RTP packets are compressed with the ROHC library, the library might access some memory outside packet boundaries. This may cause the library to crash.

The attached capture contains:
 - one IPv4 packet with partial IPv4 header,
 - one IPv6 packet with partial IPv6 header,
 - one IPv4/UDP packet with partial UDP header,
 - one IPv4/UDP/RTP packet with partial RTP header.

Problem reported by Yura.

See original description
Revision history for this message
Didier Barvaux (didier-barvaux) wrote :
Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fixed in trunk. See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/674

Didier Barvaux (didier-barvaux)
description: updated
Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fix backported to the 1.5.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/568

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fix backported to the 1.4.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/367

Revision history for this message
Didier Barvaux (didier-barvaux) wrote :

Fix backported to the 1.3.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.3.x/revision/216

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.