summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@gnumonks.org>2015-12-28 21:03:10 +0100
committerDaniel Willmann <dwillmann@sysmocom.de>2016-02-04 15:41:26 +0100
commit34caf230c9e8e388b35c642a885c3dc7bddeee77 (patch)
treed4f51758bdce16e3023fac6c3a006b73d0ac0f50
parent92b80df446889d98d45b1ac09b2de18a5ad4cfa4 (diff)
rtp_proxy.c: Ensure msgb_alloc is large enough for largest AMR frame
In AMR 12.2 (mode 7), the actual RTP payload is 33 bytes. Howeerver, as we store the length of the (dynamically-sized) AMR payload in the first byte, our buffer needs at least 33+1 byte in size.
-rw-r--r--openbsc/src/libtrau/rtp_proxy.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c
index 8c982c976..6c0461017 100644
--- a/openbsc/src/libtrau/rtp_proxy.c
+++ b/openbsc/src/libtrau/rtp_proxy.c
@@ -172,7 +172,7 @@ static int rtp_decode(struct msgb *msg, uint32_t callref, struct msgb **data)
/* always allocate for the maximum possible size to avoid
* fragmentation */
new_msg = msgb_alloc(sizeof(struct gsm_data_frame) +
- MAX_RTP_PAYLOAD_LEN, "GSM-DATA (TCH)");
+ MAX_RTP_PAYLOAD_LEN+1, "GSM-DATA (TCH)");
if (!new_msg)
return -ENOMEM;