diff --git a/src/switch_rtp.c b/src/switch_rtp.c index 0d4420eabe..a123d93eea 100644 --- a/src/switch_rtp.c +++ b/src/switch_rtp.c @@ -2077,10 +2077,12 @@ static switch_status_t read_rtp_packet(switch_rtp_t *rtp_session, switch_size_t rtp_session->stats.inbound.packet_count++; } - if (rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) { + if ((rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) || + *bytes < rtp_header_len || + switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) || switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) { return SWITCH_STATUS_SUCCESS; } - + if (rtp_session->jb && rtp_session->recv_msg.header.version == 2 && *bytes) { if (rtp_session->recv_msg.header.m && rtp_session->recv_msg.header.pt != rtp_session->recv_te && @@ -2532,7 +2534,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_ if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) { *flags |= SFF_UDPTL_PACKET; } - + ret = (int) bytes; goto end; } @@ -2540,6 +2542,12 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_ if (bytes) { rtp_session->missed_count = 0; + if (bytes < rtp_header_len) { + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "Ignoring invalid RTP packet size of %ld bytes.\n", (long)bytes); + bytes = 0; + goto do_continue; + } + if (rtp_session->recv_msg.header.pt && (rtp_session->recv_msg.header.pt == rtp_session->cng_pt || rtp_session->recv_msg.header.pt == 13)) { return_cng_frame(); } @@ -2667,7 +2675,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_ we put up with as much as we can so we don't have to deal with being punished for doing it right. Nice guys finish last! */ - if (bytes && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) && + if (bytes > rtp_header_len && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PASS_RFC2833) && rtp_session->recv_msg.header.pt == rtp_session->recv_te) { switch_size_t len = bytes - rtp_header_len; unsigned char *packet = (unsigned char *) rtp_session->recv_msg.body; @@ -2959,7 +2967,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_read(switch_rtp_t *rtp_session, void *datalen = 0; return SWITCH_STATUS_BREAK; } else { - bytes -= rtp_header_len; + if (bytes > rtp_header_len) { + bytes -= rtp_header_len; + } } *datalen = bytes; @@ -3069,7 +3079,7 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read_frame(switch_rtp_t *rtp if (bytes < 0) { frame->datalen = 0; return bytes == -2 ? SWITCH_STATUS_TIMEOUT : SWITCH_STATUS_GENERR; - } else if (bytes == 0) { + } else if (bytes < rtp_header_len) { frame->datalen = 0; return SWITCH_STATUS_BREAK; } else { @@ -3098,7 +3108,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read(switch_rtp_t *rtp_sessi *datalen = 0; return SWITCH_STATUS_GENERR; } else { - bytes -= rtp_header_len; + if (bytes > rtp_header_len) { + bytes -= rtp_header_len; + } } *datalen = bytes; @@ -3126,7 +3138,9 @@ static int rtp_common_write(switch_rtp_t *rtp_session, send_msg->header.pt = rtp_session->te; } data = send_msg->body; - datalen -= rtp_header_len; + if (datalen > rtp_header_len) { + datalen -= rtp_header_len; + } } else { uint8_t m = 0;