srtp/srtcp: add sanity check for rtcp->tag_len

Ref: https://sonarcloud.io/project/issues?issues=AX9vBNA_YH-a2i9ountq&open=AX9vBNA_YH-a2i9ountq&id=baresip_re
baresip · Mar 16, 2022 · 198fbd9 · 198fbd9
1 parent 3e7a32a
commit 198fbd9
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/srtp/srtcp.c b/src/srtp/srtcp.c
@@ -172,6 +172,9 @@ int srtcp_decrypt(struct srtp *srtp, struct mbuf *mb)
 		uint8_t tag_pkt[SHA_DIGEST_LENGTH] = {0};
 		const size_t tag_start = mb->pos;
 
+		if (rtcp->tag_len > SHA_DIGEST_LENGTH)
+			return ERANGE;
+
 		err = mbuf_read_mem(mb, tag_pkt, rtcp->tag_len);
 		if (err)
 			return err;