FSCORE-635

src/switch_rtp.c

@@ -2077,10 +2077,12 @@ static switch_status_t read_rtp_packet(switch_rtp_t *rtp_session, switch_size_t
 		rtp_session->stats.inbound.packet_count++;
 	}
 
-	if (rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) {
+	if ((rtp_session->recv_te && rtp_session->recv_msg.header.pt == rtp_session->recv_te) || 
+		*bytes < rtp_header_len ||
+		switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) || switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) {
 		return SWITCH_STATUS_SUCCESS;
 	}
-
+	
 
 	if (rtp_session->jb && rtp_session->recv_msg.header.version == 2 && *bytes) {
 		if (rtp_session->recv_msg.header.m && rtp_session->recv_msg.header.pt != rtp_session->recv_te && 
@@ -2532,7 +2534,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
 			if (switch_test_flag(rtp_session, SWITCH_RTP_FLAG_UDPTL)) {
 				*flags |= SFF_UDPTL_PACKET;
 			}
-
+			
 			ret = (int) bytes;
 			goto end;
 		}
@@ -2540,6 +2542,12 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
 		if (bytes) {
 			rtp_session->missed_count = 0;
 
+			if (bytes < rtp_header_len) {
+				switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "Ignoring invalid RTP packet size of %ld bytes.\n", (long)bytes);
+				bytes = 0;
+				goto do_continue;
+			}
+			
 			if (rtp_session->recv_msg.header.pt && (rtp_session->recv_msg.header.pt == rtp_session->cng_pt || rtp_session->recv_msg.header.pt == 13)) {
 				return_cng_frame();
 			}
@@ -2667,7 +2675,7 @@ static int rtp_common_read(switch_rtp_t *rtp_session, switch_payload_t *payload_
 		   we put up with as much as we can so we don't have to deal with being punished for
 		   doing it right. Nice guys finish last!
 		*/
-		if (bytes && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) &&
+		if (bytes > rtp_header_len && !switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PROXY_MEDIA) &&
 			!switch_test_flag(rtp_session, SWITCH_RTP_FLAG_PASS_RFC2833) && rtp_session->recv_msg.header.pt == rtp_session->recv_te) {
 			switch_size_t len = bytes - rtp_header_len;
 			unsigned char *packet = (unsigned char *) rtp_session->recv_msg.body;
@@ -2959,7 +2967,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_read(switch_rtp_t *rtp_session, void
 		*datalen = 0;
 		return SWITCH_STATUS_BREAK;
 	} else {
-		bytes -= rtp_header_len;
+		if (bytes > rtp_header_len) {
+			bytes -= rtp_header_len;
+		}
 	}
 
 	*datalen = bytes;
@@ -3069,7 +3079,7 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read_frame(switch_rtp_t *rtp
 	if (bytes < 0) {
 		frame->datalen = 0;
 		return bytes == -2 ? SWITCH_STATUS_TIMEOUT : SWITCH_STATUS_GENERR;
-	} else if (bytes == 0) {
+	} else if (bytes < rtp_header_len) {
 		frame->datalen = 0;
 		return SWITCH_STATUS_BREAK;
 	} else {
@@ -3098,7 +3108,9 @@ SWITCH_DECLARE(switch_status_t) switch_rtp_zerocopy_read(switch_rtp_t *rtp_sessi
 		*datalen = 0;
 		return SWITCH_STATUS_GENERR;
 	} else {
-		bytes -= rtp_header_len;
+		if (bytes > rtp_header_len) {
+			bytes -= rtp_header_len;
+		}
 	}
 
 	*datalen = bytes;
@@ -3126,7 +3138,9 @@ static int rtp_common_write(switch_rtp_t *rtp_session,
 			send_msg->header.pt = rtp_session->te;
 		}
 		data = send_msg->body;
-		datalen -= rtp_header_len;
+		if (datalen > rtp_header_len) {
+			datalen -= rtp_header_len;
+		}
 	} else {
 		uint8_t m = 0;