decompressor crash with truncated UOR-2 packets of the RTP profile
Bug #1181829 reported by
Didier Barvaux
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
rohc | Status tracked in Rohc-main | |||||
1.3.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
1.4.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
Rohc-1.5.x |
Fix Released
|
Critical
|
Didier Barvaux | |||
Rohc-main |
Fix Released
|
Critical
|
Didier Barvaux |
Bug Description
The UOR-2 packets of the RTP profile got an additional 1-byte field wrt the non-RTP UOR-2 packet. The minimal length of the UOR-2 packets is checked, but the additional byte is not taken into account. So a truncated UOR-2 packet can crash or assert the decompressor.
To post a comment you must log in.
Fixed in main branch. See http:// bazaar. launchpad. net/~didier- barvaux/ rohc/main/ revision/ 733