Skip to content

rtp: validate packet bounds and preserve SRTP overhead - #290

Open
chemag wants to merge 2 commits into
sepfy:mainfrom
chemag:fix-rtp-parsing-and-sizing
Open

chemag wants to merge 2 commits into
sepfy:mainfrom
chemag:fix-rtp-parsing-and-sizing

Conversation

@chemag

@chemag chemag commented Oct 30, 2026

Copy link
Copy Markdown

Summary

Validate complete RTP packet framing before media depacketization.

  • Account for CSRC lists, header extensions, and padding.
  • Reject invalid RTP versions and truncated extension or padding fields.
  • Bound generic payloads and H.264 single-NAL, STAP-A, and FU-A inputs.
  • Reject empty NAL units, oversized fragments, continuation fragments without a start, and incomplete trailing STAP-A data.
  • Size protected-packet storage with libSRTP's SRTP_MAX_TRAILER_LEN rather than a hard-coded value smaller than the documented maximum.

Testing

  • Focused RTP regression passed with GCC.
  • Focused RTP regression passed with Clang ASan and UBSan.
  • GCC 11 and CMake 3.31 full source build passed.
  • test_chrome_rtp, test_dtls, test_sdp, and test_stun passed.
  • The RTP regression covers CSRC and extension parsing, valid and invalid padding, malformed lengths, H.264 packetization bounds, incomplete STAP-A, generic payload limits, protected-packet capacity, and an MTU-spanning H.264 FU-A round trip.

chemag and others added 2 commits October 30, 2026 15:17
Account for CSRC lists, header extensions, and padding before media
depacketization. Reject invalid RTP versions and truncated extension or
padding fields before exposing payload bytes.

Bound generic payloads and H.264 single-NAL, STAP-A, and FU-A inputs. Reject
empty NAL units, oversized fragments, continuation fragments without a start,
and trailing incomplete STAP-A data.

Add focused regressions for valid extension and padding layouts, malformed
lengths, H.264 packetization bounds, and generic payload limits.

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Codex <codex@openai.com>
libSRTP can append up to SRTP_MAX_TRAILER_LEN bytes while protecting an
RTP packet. The encoder and peer receive path reserved a hard-coded 128
bytes, less than the current libSRTP maximum of 144 bytes.

Size both packet buffers from the library constant so a CONFIG_MTU packet
can be protected and received without truncating or exceeding storage.
Extend the RTP regression with an MTU-spanning H.264 FU-A round trip and
assert the shared protected-packet capacity.

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Codex <codex@openai.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant