#7 crash in rdb.c when many consecutive SRTCP packets are lost

open
nobody
None
5
2007-05-28
2007-05-28
Per Cederqvist
No

The replay database contains a buffer overflow. If the first 513 RTCP packets are lost (or if an evil partner starts the RTCP index at 513 instead of 0) the rdb_add_index() function will attempt to modify memory outside of the rdb_t structure.

I enclose two patches. The first adds a new test case to replay_driver, which at least on my computer crashes with a segmentation fault. The second patch fixes the problem.

(rdbx.c seems to already contain the fix.)

Discussion

  • Per Cederqvist
    Per Cederqvist
    2007-05-28

    New test case.

     
    Attachments
  • Per Cederqvist
    Per Cederqvist
    2007-05-28

    Fix for bug.

     
    Attachments
  • Per Cederqvist
    Per Cederqvist
    2007-05-28

    Logged In: YES
    user_id=129207
    Originator: YES

    File Added: rdb.patch

     
  • I believe this is the same problem that I discovered, and fixed, separately. I've added your test case to the rdb driver.