falconia has uploaded this change for review.
rtp2trau HR to DL: validate ToC octet of RFC 5993
This validation serves two purposes:
* Payloads that just happen to be 15 bytes long but aren't valid
RFC 5993 should be rejected;
* Super-5993 extensions of TW-TS-002 are valid only in UL, not in DL
- catch and block them.
Change-Id: Ibbaa1e1e12254eaf75a999dd1b58e2145eff158c
---
M src/trau/trau_rtp_conv.c
1 file changed, 13 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/26/39626/1
diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c
index 1114aaf..9c7ff47 100644
--- a/src/trau/trau_rtp_conv.c
+++ b/src/trau/trau_rtp_conv.c
@@ -664,6 +664,12 @@
case GSM_HR_BYTES:
break;
case GSM_HR_BYTES_RTP_RFC5993:
+ /* Require RFC 5993 valid frame, i.e., no BFIs etc.
+ * Specifically, require (F==0 && (FT==0 || FT==2));
+ * masking with 0xD0 is a clever way of effecting
+ * this check. */
+ if (data[0] & 0xD0)
+ return -EINVAL;
data++;
data_len--;
break;
@@ -707,6 +713,12 @@
case GSM_HR_BYTES:
break;
case GSM_HR_BYTES_RTP_RFC5993:
+ /* Require RFC 5993 valid frame, i.e., no BFIs etc.
+ * Specifically, require (F==0 && (FT==0 || FT==2));
+ * masking with 0xD0 is a clever way of effecting
+ * this check. */
+ if (data[0] & 0xD0)
+ return -EINVAL;
data++;
data_len--;
break;
@@ -1580,7 +1592,7 @@
* defined in ETSI TS 101 318 for FR, HR and EFR; the ones for FR and EFR
* are also duplicated in RFC 3551. In the case of HR codec, RFC 5993 input
* is also appropriate as specified in 3GPP TS 48.103 - as long as the user
- * remembers that the extra header octet is ignored.
+ * remembers that the extra header octet is ignored beyond validation check.
*
* - The only correct way to implement TrFO for GSM, accepting FR/HR/EFR from
* call leg A uplink in TW-TS-001 or TW-TS-002 format and generating TRAU-DL
To view, visit change 39626. To unsubscribe, or for help writing mail filters, visit settings.