Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

decryptRTCP() should check min length #210

Open
yuanchao0310 opened this issue Jun 15, 2022 · 0 comments
Open

decryptRTCP() should check min length #210

yuanchao0310 opened this issue Jun 15, 2022 · 0 comments

Comments

@yuanchao0310
Copy link

Your environment.

  • Version: master
  • Browser: include version
  • Other Information - stacktraces, related issues, suggestions how to fix, links for us to have context

What did you do?

What did you expect?

What happened?

func (c *Context) decryptRTCP(dst, encrypted []byte) ([]byte, error) {
	out := allocateIfMismatch(dst, encrypted)

	authTagLen, err := c.cipher.rtcpAuthTagLen()
	if err != nil {
		return nil, err
	}
	aeadAuthTagLen, err := c.cipher.aeadAuthTagLen()
	if err != nil {
		return nil, err
	}
	tailOffset := len(encrypted) - (authTagLen + srtcpIndexSize)

	if tailOffset < aeadAuthTagLen {
		return nil, fmt.Errorf("%w: %d", errTooShortRTCP, len(encrypted))
	} else if isEncrypted := encrypted[tailOffset] >> 7; isEncrypted == 0 {
		return out, nil
	}

	index := c.cipher.getRTCPIndex(encrypted)
	ssrc := binary.BigEndian.Uint32(encrypted[4:])

	s := c.getSRTCPSSRCState(ssrc)
	markAsValid, ok := s.replayDetector.Check(uint64(index))
	if !ok {
		return nil, &duplicatedError{Proto: "srtcp", SSRC: ssrc, Index: index}
	}

	out, err = c.cipher.decryptRTCP(out, encrypted, index, ssrc)
	if err != nil {
		return nil, err
	}

	markAsValid()
	return out, nil
}

srtcp data length min length should be 8 + aeadAuthTagLen + authTagLen + srtcpIndexSize
8 is rtcp header(4 bytes + 4 bytes ssrc)

assume a srtcp packet is 4 + aeadAuthTagLen + authTagLen + srtcpIndexSize, then

ssrc := binary.BigEndian.Uint32(encrypted[4:])

will get a wrong value. so need check if len(encrypted) >= min length in decryptRTCP function

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant