[asterisk-bugs] [JIRA] (ASTERISK-27429) res_rtp_asterisk: Multiple reports in an RTCP packet will write past where it should

[Asterisk Team (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-27429?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Asterisk Team updated ASTERISK-27429:
-------------------------------------

    Target Release Version/s: 15.2.0

> res_rtp_asterisk: Multiple reports in an RTCP packet will write past where it should
> ------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-27429
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27429
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_asterisk
>    Affects Versions: 13.18.2, 14.7.2, 15.1.2
>            Reporter: Vitezslav Novy
>            Assignee: Joshua Colp
>      Target Release: 13.18.4, 13.19.0, 14.7.4, 15.1.4, 15.2.0
>
>         Attachments: AST-2017-012-13.diff, AST-2017-012.txt
>
>
> There is logic in res_rtp_asterisk which handles RTCP RR/SR record report blocks.  This code was originally written to handle a single RR/SR report but during HEP work the code was changed so multiple RR/SR reports could be handled.  However, report_counter is not reset between processing RR/SR records which can result in writing outside of allocated memory on the next RR/SR record in the packet.



--
This message was sent by Atlassian JIRA
(v6.2#6252)