From 8758879a7c2bb920e6a789351d092ed4ed4e82ed Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Wed, 30 Jul 2025 10:59:46 -0400 Subject: [PATCH] MT#63317 fix RTP extension parsing Change-Id: Ie62fa4ed2dc16d42d579c34b1fe541955759dfed (cherry picked from commit 262d1f7b5e860e442b0db5cdc203de3a4319c847) --- kernel-module/xt_RTPENGINE.c | 4 ++-- lib/rtplib.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index f881a8122..cb8b9efd7 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -4202,7 +4202,7 @@ drop: /* XXX shared code */ static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) { struct rtp_extension *ext; - int ext_len; + size_t ext_len; if (skb->len < sizeof(*rtp->rtp_header)) goto error; @@ -4223,7 +4223,7 @@ static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) { if (rtp->payload_len < sizeof(*ext)) goto error; ext = (void *) rtp->payload; - ext_len = 4 + ntohs(ext->length) * 4; + ext_len = sizeof(*ext) + 4 + ntohs(ext->length) * 4; if (rtp->payload_len < ext_len) goto error; rtp->payload += ext_len; diff --git a/lib/rtplib.c b/lib/rtplib.c index 766404c9e..64d84bbfc 100644 --- a/lib/rtplib.c +++ b/lib/rtplib.c @@ -91,7 +91,7 @@ int rtp_payload(struct rtp_header **out, str *p, const str *s) { goto error; ext = (void *) p->s; err = "short packet (header extensions)"; - if (str_shift(p, 4 + ntohs(ext->length) * 4)) + if (str_shift(p, sizeof(*ext) + 4 + ntohs(ext->length) * 4)) goto error; }