From 7895e0456a4e3fb48344932e4ca83d216038eadf Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Fri, 28 Oct 2016 10:40:24 +0200 Subject: Fix metadata corruption Use separate pointer for payload to make sure mblk->b_rptr is not advanced (which breaks the use of rtp_get_* macros that assume mblk->b_rptr is pointing to the RTP header, not the payload). Committed by: Max Change-Id: I205630e1da98693ba0ac25e86e21780284185077 Related: OS#1802 --- src/trau/osmo_ortp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src/trau/osmo_ortp.c') diff --git a/src/trau/osmo_ortp.c b/src/trau/osmo_ortp.c index fc63e7f..e7c6fc4 100644 --- a/src/trau/osmo_ortp.c +++ b/src/trau/osmo_ortp.c @@ -145,14 +145,15 @@ static void ortp_sig_cb_ts(RtpSession *rs, void *data) static inline bool recv_with_cb(struct osmo_rtp_socket *rs) { + uint8_t *payload; mblk_t *mblk = rtp_session_recvm_with_ts(rs->sess, rs->rx_user_ts); if (!mblk) return false; - int plen = rtp_get_payload(mblk, &mblk->b_rptr); + int plen = rtp_get_payload(mblk, &payload); /* hand into receiver */ if (rs->rx_cb && plen > 0) - rs->rx_cb(rs, mblk->b_rptr, plen, rtp_get_seqnumber(mblk), + rs->rx_cb(rs, payload, plen, rtp_get_seqnumber(mblk), rtp_get_timestamp(mblk), rtp_get_markbit(mblk)); freemsg(mblk); if (plen > 0) -- cgit v1.2.3