Fixed length check for RTCP FB SLI and RPSI parsing (#4069)

pjsip · Sep 11, 2024 · f67e3ed · f67e3ed
1 parent 9b6744f
commit f67e3ed
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/pjmedia/src/pjmedia/rtcp_fb.c b/pjmedia/src/pjmedia/rtcp_fb.c
@@ -704,7 +704,8 @@ PJ_DEF(pj_status_t) pjmedia_rtcp_fb_parse_sli(
         return PJ_ETOOSMALL;
     }
 
-    cnt = pj_ntohs((pj_uint16_t)hdr->rtcp_common.length) - 2;
+    cnt = pj_ntohs((pj_uint16_t)hdr->rtcp_common.length);
+    if (cnt > 2) cnt -= 2; else cnt = 0;
     if (length < (cnt+3)*4)
         return PJ_ETOOSMALL;
 
@@ -755,7 +756,9 @@ PJ_DEF(pj_status_t) pjmedia_rtcp_fb_parse_rpsi(
         return PJ_ETOOSMALL;
     }
 
-    rpsi_len = (pj_ntohs((pj_uint16_t)hdr->rtcp_common.length)-2) * 4;
+    rpsi_len = pj_ntohs((pj_uint16_t)hdr->rtcp_common.length);
+    if (rpsi_len > 2) rpsi_len -= 2; else rpsi_len = 0;
+    rpsi_len *= 4;
     if (length < rpsi_len + 12)
         return PJ_ETOOSMALL;