Skip to content

V
vlc-2-2
Commit da9a1a29 authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont
Browse files
Options

SRTP: integer overflow 

(cherry picked from commit e76f990e0ba00a9f573c23627ecd66cb9ae9bdd5)
parent f832dd02
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 2 deletions
modules/access/rtp/srtp.c
View file @ da9a1a29
......@@ -738,7 +738,7 @@ static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
{
/* Packet in the future, good */
s->rtcp.window = s->rtcp.window << diff;
s->rtcp.window |= 1;
s->rtcp.window |= UINT64_C(1);
s->rtcp_index = index;
}
else
......@@ -747,7 +747,7 @@ static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
diff = -diff;
if ((diff >= 64) || ((s->rtcp.window >> diff) & 1))
return EACCES; // replay attack!
s->rtp.window |= 1 << diff;
s->rtp.window |= UINT64_C(1) << diff;
}
/* Crypts SRTCP */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment