neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-netif/+/38071?usp=email ) Change subject: osmo_rtp_get_payload(): fix bounds check for padding ...................................................................... osmo_rtp_get_payload(): fix bounds check for padding If we want to read a padding length octet from the end, payload_len must be >= 1. Change-Id: I071ad2f799bb4cfecf349c5a25bf7a46da6128dc --- M src/rtp.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-netif refs/changes/71/38071/1 diff --git a/src/rtp.c b/src/rtp.c index f4b0ada..77905f2 100644 --- a/src/rtp.c +++ b/src/rtp.c @@ -140,7 +140,7 @@ } } if (rtph->padding) { - if (payload_len < 0) { + if (payload_len < 1) { DEBUGPC(DLMUX, "received RTP frame too short for " "padding length\n"); return NULL; -- To view, visit https://gerrit.osmocom.org/c/libosmo-netif/+/38071?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-netif Gerrit-Branch: master Gerrit-Change-Id: I071ad2f799bb4cfecf349c5a25bf7a46da6128dc Gerrit-Change-Number: 38071 Gerrit-PatchSet: 1 Gerrit-Owner: neels &lt;nhofmeyr(a)sysmocom.de&gt;