From 89937b925bfc74fdf28ee007e52a08aa58a1a6ec Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Thu, 28 Aug 2025 14:19:44 -0400 Subject: [PATCH] MT#63317 re-fix extension parsing Basically a revert of Ie62fa4ed Maybe this is correct now? Change-Id: Ia2b1b5d35c2a209430a23110f1b929e2b1ac80fb (cherry picked from commit 8a3d8c911d657808773d61d812d2413f00e059e9) (cherry picked from commit 4afce7e0fadd809c19084136397a25dbd07691f6) --- kernel-module/xt_RTPENGINE.c | 2 +- lib/rtplib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index cb8b9efd7..5142d3dff 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -4223,7 +4223,7 @@ static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) { if (rtp->payload_len < sizeof(*ext)) goto error; ext = (void *) rtp->payload; - ext_len = sizeof(*ext) + 4 + ntohs(ext->length) * 4; + ext_len = sizeof(*ext) + ntohs(ext->length) * 4; if (rtp->payload_len < ext_len) goto error; rtp->payload += ext_len; diff --git a/lib/rtplib.c b/lib/rtplib.c index 64d84bbfc..cf53adf3e 100644 --- a/lib/rtplib.c +++ b/lib/rtplib.c @@ -91,7 +91,7 @@ int rtp_payload(struct rtp_header **out, str *p, const str *s) { goto error; ext = (void *) p->s; err = "short packet (header extensions)"; - if (str_shift(p, sizeof(*ext) + 4 + ntohs(ext->length) * 4)) + if (str_shift(p, sizeof(*ext) + ntohs(ext->length) * 4)) goto error; }