#6 Core dump is caused by SRTCP packets

[Roman Shpount]

There is an invalid index access in rdb.c when adding an index. When the sequence number of the SRTCP packet is outside of window by more then window size, a bit is set outside of the window bitmap. When sequence number is outside of the window size by more then one, a wrong bit is set. This bug was also reported in srtp implementation of Asterisk (https://issues.asterisk.org/bug_view_page.php?bug_id=17976&history=1). Here is the proposed fix.

In the current code in rdb.c:
err_status_t
rdb_add_index(rdb_t *rdb, uint32_t index) {
uint32_t delta;

/* here we *assume* that index > rdb->window_start */

delta = (index - rdb->window_start);
if (delta < rdb_bits_in_bitmask) {

/* if the index is within the window, set the appropriate bit */
v128_set_bit(&rdb->bitmask, delta);

} else {

delta -= rdb_bits_in_bitmask - 1;

/* shift the window forward by delta bits*/
v128_left_shift(&rdb->bitmask, delta);
v128_set_bit(&rdb->bitmask, rdb_bits_in_bitmask-delta);
rdb->window_start += delta;

}

return err_status_ok;
}

It should be:

err_status_t
rdb_add_index(rdb_t *rdb, uint32_t index) {
uint32_t delta;

/* here we *assume* that index > rdb->window_start */

delta = (index - rdb->window_start);
if (delta < rdb_bits_in_bitmask) {

/* if the index is within the window, set the appropriate bit */
v128_set_bit(&rdb->bitmask, delta);

} else {

delta -= rdb_bits_in_bitmask - 1;

/* shift the window forward by delta bits*/
v128_left_shift(&rdb->bitmask, delta);
v128_set_bit(&rdb->bitmask, rdb_bits_in_bitmask-1);
rdb->window_start += delta;

}

return err_status_ok;
}