#7 crash in rdb.c when many consecutive SRTCP packets are lost

[Per Cederqvist]

The replay database contains a buffer overflow. If the first 513 RTCP packets are lost (or if an evil partner starts the RTCP index at 513 instead of 0) the rdb_add_index() function will attempt to modify memory outside of the rdb_t structure.

I enclose two patches. The first adds a new test case to replay_driver, which at least on my computer crashes with a segmentation fault. The second patch fixes the problem.

(rdbx.c seems to already contain the fix.)

[Per Cederqvist]

New test case.

[Per Cederqvist]

Fix for bug.

[Per Cederqvist]

Logged In: YES
user_id=129207
Originator: YES

File Added: rdb.patch

[Jonathan Lennox]

I believe this is the same problem that I discovered, and fixed, separately. I've added your test case to the rdb driver.