From ae46036cc78dc7b4a7c05f0b4744cf61ecc947a3 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Tue, 5 May 2015 14:13:11 -0400
Subject: [PATCH] RTCP logging fixes

---
 daemon/rtcp.c    | 15 ++++++++++++---
 daemon/rtcp_xr.c |  3 +++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index 5a0eeb7b2..2006bebdb 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -520,18 +520,24 @@ void print_rtcp_rr(char** cdrbufcur, const pjmedia_rtcp_rr* rr) {
 void parse_and_log_rtcp_report(struct stream_fd *sfd, const void *pkt, long size) {
 
 	static const int CDRBUFLENGTH = 1024*1024*1; // 1 MB
-	char cdrbuffer[CDRBUFLENGTH]; memset(&cdrbuffer,0,CDRBUFLENGTH);
+	char cdrbuffer[CDRBUFLENGTH];
 	char* cdrbufcur = cdrbuffer;
 	pjmedia_rtcp_common *common = (pjmedia_rtcp_common*) pkt;
 	const pjmedia_rtcp_rr *rr = NULL;
 	const pjmedia_rtcp_sr *sr = NULL;
 
-	cdrbufcur += sprintf(cdrbufcur,"[%s] ",sfd->stream->call->callid);
+	cdrbufcur += sprintf(cdrbufcur,"["STR_FORMAT"] ", STR_FMT(&sfd->stream->call->callid));
+
+	if (size < sizeof(*common))
+		return;
 
 	print_rtcp_common(&cdrbufcur,common);
 
 	/* Parse RTCP */
 	if (common->pt == RTCP_PT_SR) {
+		if (size < (sizeof(*common) + sizeof(*sr)))
+			return;
+
 		sr = (pjmedia_rtcp_sr*) (((char*)pkt) + sizeof(pjmedia_rtcp_common));
 
 		print_rtcp_sr(&cdrbufcur,sr);
@@ -542,11 +548,14 @@ void parse_and_log_rtcp_report(struct stream_fd *sfd, const void *pkt, long size
 			print_rtcp_rr(&cdrbufcur,rr);
 		}
 	} else if (common->pt == RTCP_PT_RR && common->count > 0) {
+		if (size < (sizeof(*common) + sizeof(*rr)))
+			return;
+
 		rr = (pjmedia_rtcp_rr*)(((char*)pkt) + sizeof(pjmedia_rtcp_common));
 		print_rtcp_rr(&cdrbufcur,rr);
 
 	} else if (common->pt == RTCP_PT_XR) {
-		pjmedia_rtcp_xr_rx_rtcp_xr(&cdrbufcur, pkt, size);
+		pjmedia_rtcp_xr_rx_rtcp_xr(cdrbufcur, pkt, size);
 	}
 	rtcplog(cdrbuffer);
 }
diff --git a/daemon/rtcp_xr.c b/daemon/rtcp_xr.c
index b43cea3dc..39e1a7764 100644
--- a/daemon/rtcp_xr.c
+++ b/daemon/rtcp_xr.c
@@ -115,6 +115,9 @@ void pjmedia_rtcp_xr_rx_rtcp_xr(char* cdrbufcur, const void *pkt, size_t size) {
 								rtcp_xr->buf;
 	unsigned pkt_len, rb_len;
 
+	if (size < sizeof(*rtcp_xr))
+		return;
+
 	if (rtcp_xr->common.pt != RTCP_XR)
 		return;