FSCORE-635

diff --git a/src/switch_rtp.c b/src/switch_rtp.c
index 0d4420eabe93a6a0f32030dd101d159526ba6579..a123d93eea8fb6a48f19d850fa607693c322ae69 100644 (file)
--- a/src/switch_rtp.c
+++ b/src/switch_rtp.c
@@ -2077,10 +2077,12 @@ static switch_status_t read_rtp_packet(switch_rtp_t *rtp_session, switch_size_t
                rtp_session->stats.inbound.packet_count++;
        }
 
-       if (rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) {
+       if ((rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) || 
+               *bytes < rtp_header_len ||
+               switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) || switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) {
                return SWITCH_STATUS_SUCCESS;
        }
-
+       
 
        if (rtp_session->jb && rtp_session->recv_msg.header.version == 2 && *bytes) {
                if (rtp_session->recv_msg.header.m && rtp_session->recv_msg.header.pt != rtp_session->recv_te && 
@@ -2532,7 +2534,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
                        if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) {
                                *flags |= SFF_UDPTL_PACKET;
                        }
-
+                       
                        ret = (int) bytes;
                        goto end;
                }
@@ -2540,6 +2542,12 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
                if (bytes) {
                        rtp_session->missed_count = 0;
 
+                       if (bytes < rtp_header_len) {
+                               switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "Ignoring invalid RTP packet size of %ld bytes.\n", (long)bytes);
+                               bytes = 0;
+                               goto do_continue;
+                       }
+                       
                        if (rtp_session->recv_msg.header.pt && (rtp_session->recv_msg.header.pt == rtp_session->cng_pt || rtp_session->recv_msg.header.pt == 13)) {
                                return_cng_frame();
                        }
@@ -2667,7 +2675,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
                   we put up with as much as we can so we don't have to deal with being punished for
                   doing it right. Nice guys finish last!
                */
-               if (bytes && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) &&
+               if (bytes > rtp_header_len && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) &&
                        !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PASS_RFC2833) && rtp_session->recv_msg.header.pt == rtp_session->recv_te) {
                        switch_size_t len = bytes - rtp_header_len;
                        unsigned char *packet = (unsigned char *) rtp_session->recv_msg.body;
@@ -2959,7 +2967,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_read(switch_rtp_t *rtp_session, void
                *datalen = 0;
                return SWITCH_STATUS_BREAK;
        } else {
-               bytes -= rtp_header_len;
+               if (bytes > rtp_header_len) {
+                       bytes -= rtp_header_len;
+               }
        }
 
        *datalen = bytes;
@@ -3069,7 +3079,7 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read_frame(switch_rtp_t *rtp
        if (bytes < 0) {
                frame->datalen = 0;
                return bytes == -2 ? SWITCH_STATUS_TIMEOUT : SWITCH_STATUS_GENERR;
-       } else if (bytes == 0) {
+       } else if (bytes < rtp_header_len) {
                frame->datalen = 0;
                return SWITCH_STATUS_BREAK;
        } else {
@@ -3098,7 +3108,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read(switch_rtp_t *rtp_sessi
                *datalen = 0;
                return SWITCH_STATUS_GENERR;
        } else {
-               bytes -= rtp_header_len;
+               if (bytes > rtp_header_len) {
+                       bytes -= rtp_header_len;
+               }
        }
 
        *datalen = bytes;
@@ -3126,7 +3138,9 @@ static int rtp_common_write(switch_rtp_t *rtp_session,
                        send_msg->header.pt = rtp_session->te;
                }
                data = send_msg->body;
-               datalen -= rtp_header_len;
+               if (datalen > rtp_header_len) {
+                       datalen -= rtp_header_len;
+               }
        } else {
                uint8_t m = 0;