summaryrefslogtreecommitdiffstats
path: root/openbsc/src/libtrau/rtp_proxy.c
diff options
context:
space:
mode:
Diffstat (limited to 'openbsc/src/libtrau/rtp_proxy.c')
-rw-r--r--openbsc/src/libtrau/rtp_proxy.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c
index d8fde15d1..dfb3635ad 100644
--- a/openbsc/src/libtrau/rtp_proxy.c
+++ b/openbsc/src/libtrau/rtp_proxy.c
@@ -239,26 +239,35 @@ int rtp_send_frame(struct rtp_socket *rs, struct gsm_data_frame *frame)
switch (frame->msg_type) {
case GSM_TCHF_FRAME:
+ if ((frame->data[0] >> 4) != 0xd)
+ goto bfi;
payload_type = RTP_PT_GSM_FULL;
payload_len = RTP_LEN_GSM_FULL;
duration = RTP_GSM_DURATION;
break;
case GSM_TCHF_FRAME_EFR:
+ if ((frame->data[0] >> 4) != 0xc)
+ goto bfi;
payload_type = (dynamic_pt) ? : RTP_PT_GSM_EFR;
payload_len = RTP_LEN_GSM_EFR;
duration = RTP_GSM_DURATION;
break;
case GSM_TCHH_FRAME:
+ if ((frame->data[0] & 0xf0) != 0x00)
+ goto bfi;
payload_type = (dynamic_pt) ? : RTP_PT_GSM_HALF;
payload_len = RTP_LEN_GSM_HALF;
duration = RTP_GSM_DURATION;
break;
case GSM_TCH_FRAME_AMR:
+ if ((frame->data[2] & 0x04) != 0x04)
+ goto bfi;
payload_type = (dynamic_pt) ? : RTP_PT_AMR;
payload_len = frame->data[0];
duration = RTP_GSM_DURATION;
break;
case GSM_BAD_FRAME:
+bfi:
payload_type = 0;
payload_len = 0;
duration = RTP_GSM_DURATION;