Giters

pion / srtp

A Go implementation of SRTP

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Out-of-bounds access in DecryptRTCP

thinkski opened this issue · comments

commented

On line 14, out is truncated to length tailOffset:
https://github.com/pions/srtp/blob/bc58b55b1a0d101267701ae3ea00412cb77bc918/srtcp.go#L14

However, on line 21, access of out[tailOffset:] is attempted, which results in an out-of-bounds panic:
https://github.com/pions/srtp/blob/bc58b55b1a0d101267701ae3ea00412cb77bc918/srtcp.go#L21

Believe line 21 should be:

srtcpIndexBuffer := encrypted[tailOffset : tailOffset+srtcpIndexSize]
commented

Oof nice catch @thinkski

It’s a bummer that none of the tests caught this. I will have to figure out why, I guess we only test unencrypted RTCP?

You up for opening a PR for this? I can grab instead if you are busy!