osmocom
/
libosmocore
mirror of https://gerrit.osmocom.org/libosmocore
11
0
Fork 0
Code Issues Releases Wiki Activity

Add null-pointer check to osmo_amr_rtp_dec() 

Check that RTP payload we're about to decode is not NULL and return
proper error code instead of segfaulting. Add corresponding test case.

Change-Id: Ib6cda9900a41ed16bbfbde9df3de9d38e0a7469b
This commit is contained in:
Max 2016-11-07 14:49:13 +01:00
parent 8b25a3f5c3
commit e9e5f8e4e9
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/codec/gsm690.c
View File

@ -252,6 +252,9 @@ int osmo_amr_rtp_dec(const uint8_t *rtppayload, int payload_len, uint8_t *cmr,
int8_t *cmi, enum osmo_amr_type *ft,
enum osmo_amr_quality *bfi, int8_t *sti)
{
if (payload_len < 2 || !rtppayload)
return -EINVAL;
/* RFC 4867 § 4.4.2 ToC - compound payloads are not supported: F = 0 */
uint8_t type = (rtppayload[1] >> 3) & 0xf;
@ -262,9 +265,6 @@ int osmo_amr_rtp_dec(const uint8_t *rtppayload, int payload_len, uint8_t *cmr,
if (payload_len - 2 < amr_len_by_ft[type])
return -ENOTSUP;
if (payload_len < 2)
return -EINVAL;
if (ft)
*ft = type;

12
tests/codec/codec_test.c
View File

@ -38,12 +38,17 @@ static const char * cmpr(int a, int b)
static void test_sid_dec(const uint8_t *t, size_t len)
{
uint8_t cmr, tmp[SID_LEN];
uint8_t cmr, tmp[SID_LEN], *t2 = NULL;
enum osmo_amr_type ft;
enum osmo_amr_quality bfi;
int8_t sti, cmi;
memcpy(tmp, t, SID_LEN);
int rc = osmo_amr_rtp_dec(tmp, len, &cmr, &cmi, &ft, &bfi, &sti);
if (t) {
memcpy(tmp, t, SID_LEN);
t2 = tmp;
}
int rc = osmo_amr_rtp_dec(t2, len, &cmr, &cmi, &ft, &bfi, &sti);
if (rc < 0)
return;
printf("[%d] decode RTP %s%s: FT %s, CMR %s, CMI is %d, SID type %s\t",
rc, osmo_hexdump(tmp, len), cmpr(bfi, AMR_GOOD),
get_value_string(osmo_amr_type_names, ft),
@ -94,6 +99,7 @@ int main(int argc, char **argv)
printf("AMR RTP payload decoder test:\n");
test_sid_dec(sid_first, 7);
test_sid_dec(sid_update, 7);
test_sid_dec(NULL, 7);
test_amr_rt(0, AMR_NO_DATA, AMR_BAD);
test_amr_rt(0, AMR_NO_DATA, AMR_GOOD);
test_amr_rt(AMR_12_2, AMR_12_2, AMR_BAD);