Bug in pjmedia_rtp_decode_rtp, rtp extension

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I want to use the extended header in the rtp packets and I think I
have found a bug in pjsip.

In the function pjmedia_rtp_decode_rtp there is the following code to
calculate the offset of the payload after the extended header:

Line 169:
    /* Adjust offset if RTP extension is used. */
    if ((*hdr)->x) {
	pjmedia_rtp_ext_hdr *ext = (pjmedia_rtp_ext_hdr*)
				    (((pj_uint8_t*)pkt) + offset);
	offset += (pj_ntohs(ext->length) * sizeof(pj_uint32_t));
    }


RFC3550 says:
The header extension contains a 16-bit length field that counts the
number of 32-bit words in the extension, excluding the four-octet
extension header (therefore zero is a valid length).

In the above code ext->length is this length field. If the extension
field is set, the offset must be at least the size of the header of
the extension (struct pjmedia_rtp_ext_hdr).

By the way: The definition of the pjmedia_rtp_ext_hdr in rtp.h should
be included into a #pragma pack(1) section to define its packing.

I have seen the problem in pjproject-1.2 and 1.3.

Anyway, thanks for the great work. I like the architecture of the
framework in general very much.

Best regards,

Thomas Falk



[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux