FS-5202

diff --git a/src/mod/applications/mod_spandsp/udptl.c b/src/mod/applications/mod_spandsp/udptl.c
index 94a31e677247eb82fcfb28c067a76e743151bffd..8f74508f6254a44b765e5ded14e294e19b818e74 100644 (file)
--- a/src/mod/applications/mod_spandsp/udptl.c
+++ b/src/mod/applications/mod_spandsp/udptl.c
@@ -195,7 +195,7 @@ int udptl_rx_packet(udptl_state_t *s, const uint8_t buf[], int len)
        s->rx[x].fec_len[0] = 0;
        s->rx[x].fec_span = 0;
        s->rx[x].fec_entries = 0;
-       if ((buf[ptr++] & 0x80) == 0) {
+       if ((buf[ptr++] & 0x80) q== 0) {
                /* Secondary packet mode for error recovery */
                /* We might have the packet we want, but we need to check through
                   the redundant stuff, and verify the integrity of the UDPTL.
@@ -228,6 +228,9 @@ int udptl_rx_packet(udptl_state_t *s, const uint8_t buf[], int len)
                                        /* Save the new packet. Redundancy mode won't use this, but some systems will switch into
                                           FEC mode after sending some redundant packets, and this may then be important. */
                                        x = (seq_no - i) & UDPTL_BUF_MASK;
+                                       if (!bufs[i - 1]) {
+                                               return -1;
+                                       }
                                        memcpy(s->rx[x].buf, bufs[i - 1], lengths[i - 1]);
                                        s->rx[x].buf_len = lengths[i - 1];
                                        s->rx[x].fec_len[0] = 0;