From: Matthew Jordan Date: Wed, 12 Nov 2014 23:59:33 +0000 (+0000) Subject: main/rtp_engine: Fix crash when processing more than one RTCP report info block X-Git-Tag: 12.8.0-rc1~50 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f3f9979b8fd0905385ec300f63c2bd52b6b5ac20;p=thirdparty%2Fasterisk.git main/rtp_engine: Fix crash when processing more than one RTCP report info block Asterisk - in res_rtp_asterisk - only understands a single RTCP report info block. When the RTCP information was refactored in the RTP Engine to be pushed over the Stasis message bus, I put in the hooks into the engine to handle multiple RTCP report info blocks, in the hope that a future RTP implementation would be able to provide that data. Unfortunately, res_rtp_asterisk has a tendency to "lie": (1) It will send RTCP reports with a reception_report_count greater than 1 (which is pulled directly from the RTCP packet itself, so that part is correct) (2) It will only provide a single report block When the rtp_engine goes to convert this to a JSON blob, hilarity ensues as it looks for a report block that doesn't exist. This patch updates the rtp_engine to be a bit more skeptical about what it is presented with. While this could also be fixed in res_rtp_asterisk, this patch prefers to fix it in the engine for two reasons: (1) The engine is designed to work with multiple RTP implementation, and hence having it be more robust is a good thing (tm) (2) res_rtp_asterisk's handling of RTCP information is "fun". It should report the correct reception_report_count; ideally it should also be giving us all of the blocks - but it is *definitely* not designed to do that. Going down that road is a non-trivial effort. Review: https://reviewboard.asterisk.org/r/4158/ ASTERISK-24489 #close Reported by: Gregory Malsack Tested by: Gregory Malsack ASTERISK-24498 #close Reported by: Beppo Mazzucato Tested by: Beppo Maazucato git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@427762 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- diff --git a/main/rtp_engine.c b/main/rtp_engine.c index 5fcf077544..3a114e3d7a 100644 --- a/main/rtp_engine.c +++ b/main/rtp_engine.c @@ -1852,7 +1852,7 @@ static struct ast_json *rtcp_report_to_json(struct stasis_message *msg, return NULL; } - for (i = 0; i < payload->report->reception_report_count; i++) { + for (i = 0; i < payload->report->reception_report_count && payload->report->report_block[i]; i++) { struct ast_json *json_report_block; char str_lsr[32]; snprintf(str_lsr, sizeof(str_lsr), "%u", payload->report->report_block[i]->lsr);