From bc0287b26cf175cba4f682b5729302cd08e94fd7 Mon Sep 17 00:00:00 2001
From: Jan Willamowius <jan@willamowius.de>
Date: Tue, 5 Jan 2021 10:21:34 +0100
Subject: [PATCH] fix crash on 0 byte RTCP packet

---
 src/h460/h46018_h225.cxx | 4 ++--
 src/rtp.cxx              | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/h460/h46018_h225.cxx b/src/h460/h46018_h225.cxx
index b78d1678..21a24f62 100644
--- a/src/h460/h46018_h225.cxx
+++ b/src/h460/h46018_h225.cxx
@@ -1352,9 +1352,9 @@ PBoolean H46019UDPSocket::WriteMultiplexBuffer(const void * buf, PINDEX len, con
     m_multiMutex.Signal();
     m_multiBuffer++;
 
-    if (!rtpSocket) {
+    if (!rtpSocket && len > 0) {
         RTP_ControlFrame frame(len);
-        memcpy(frame.GetPointer(),buf,len);
+        memcpy(frame.GetPointer(), buf, len);
         if (frame.GetPayloadType() == RTP_ControlFrame::e_ApplDefined) {
             PTRACE(6, "H46024A\tReading RTCP Probe Packet.");
             PBYTEArray tempData;
diff --git a/src/rtp.cxx b/src/rtp.cxx
index febd0e5d..1638af2f 100644
--- a/src/rtp.cxx
+++ b/src/rtp.cxx
@@ -339,7 +339,8 @@ RTP_ControlFrame::RTP_ControlFrame(PINDEX sz)
 {
   compoundOffset = 0;
   compoundSize = 0;
-  theArray[0] = '\x80'; // Set version 2
+  if (sz > 0)
+    theArray[0] = '\x80'; // Set version 2
 }