MT#63317 fix RTP extension parsing

Change-Id: Ie62fa4ed2dc16d42d579c34b1fe541955759dfed
(cherry picked from commit 262d1f7b5e)
(cherry picked from commit 19e6b36bed)

kernel-module/xt_RTPENGINE.c

@@ -5131,7 +5131,7 @@ drop:
 /* XXX shared code */
 static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) {
 	struct rtp_extension *ext;
-	int ext_len;
+	size_t ext_len;
 
 	if (skb->len < sizeof(*rtp->rtp_header))
 		goto error;
@@ -5152,7 +5152,7 @@ static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) {
 		if (rtp->payload_len < sizeof(*ext))
 			goto error;
 		ext = (void *) rtp->payload;
-		ext_len = 4 + ntohs(ext->length) * 4;
+		ext_len = sizeof(*ext) + 4 + ntohs(ext->length) * 4;
 		if (rtp->payload_len < ext_len)
 			goto error;
 		rtp->payload += ext_len;

lib/rtplib.c

@@ -91,7 +91,7 @@ int rtp_payload(struct rtp_header **out, str *p, const str *s) {
 			goto error;
 		ext = (void *) p->s;
 		err = "short packet (header extensions)";
-		if (str_shift(p, 4 + ntohs(ext->length) * 4))
+		if (str_shift(p, sizeof(*ext) + 4 + ntohs(ext->length) * 4))
 			goto error;
 	}