From: Joshua C. Colp <jcolp@sangoma.com>
Date: Wed, 25 Mar 2020 09:38:53 +0000 (-0300)
Subject: res_rtp_asterisk: Ensure sufficient space for worst case NACK.
X-Git-Tag: 18.0.0-rc1~173
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96e8d411e17fc4c07800cde375e485d37cefe05b;p=thirdparty%2Fasterisk.git

res_rtp_asterisk: Ensure sufficient space for worst case NACK.

ASTERISK-28790

Change-Id: I10df52f98b19ed62575f25dab36e82d136dccd99
---

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 05a993ff86..47562f510c 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -7964,12 +7964,15 @@ static struct ast_frame *ast_rtp_read(struct ast_rtp_instance *instance, int rtc
 			int res = 0;
 			int ice;
 			int sr;
-			size_t data_size = AST_UUID_STR_LEN + 128 + (seqno - rtp->expectedrxseqno) / 17;
+			size_t data_size = AST_UUID_STR_LEN + 128 + (AST_VECTOR_SIZE(&rtp->missing_seqno) * 4);
 			RAII_VAR(unsigned char *, rtcpheader, NULL, ast_free_ptr);
 			RAII_VAR(struct ast_rtp_rtcp_report *, rtcp_report,
 					ast_rtp_rtcp_report_alloc(rtp->themssrc_valid ? 1 : 0),
 					ao2_cleanup);
 
+			/* Sufficient space for RTCP headers and report, SDES with CNAME, NACK header,
+			 * and worst case 4 bytes per missing sequence number.
+			 */
 			rtcpheader = ast_malloc(sizeof(*rtcpheader) + data_size);
 			if (!rtcpheader) {
 				ast_debug(1, "Failed to allocate memory for NACK\n");