diff options
| -rw-r--r-- | src/libtrau/rtp_proxy.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/libtrau/rtp_proxy.c b/src/libtrau/rtp_proxy.c index 3fb8b455b..8f931cf24 100644 --- a/src/libtrau/rtp_proxy.c +++ b/src/libtrau/rtp_proxy.c @@ -291,27 +291,36 @@ int rtp_send_frame(struct rtp_socket *rs, struct gsm_data_frame *frame) switch (frame->msg_type) { case GSM_TCHF_FRAME: + if ((frame->data[0] >> 4) != 0xd) + goto bfi; payload_type = RTP_PT_GSM_FULL; payload_len = 33; duration = 160; break; case GSM_TCHF_FRAME_EFR: + if ((frame->data[0] >> 4) != 0xc) + goto bfi; payload_type = (dynamic_pt) ? : RTP_PT_GSM_EFR; payload_len = 31; duration = 160; break; case GSM_TCHH_FRAME: + if ((frame->data[0] & 0xf0) != 0x00) + goto bfi; payload_type = (dynamic_pt) ? : RTP_PT_GSM_HALF; payload_len = 15; duration = 160; break; case GSM_TCH_FRAME_AMR: + if ((frame->data[1] & 0x04) != 0x04) + goto bfi; payload_type = (dynamic_pt) ? : RTP_PT_AMR; payload_len = frame->data[0]; duration = 160; amr = 1; break; case GSM_BAD_FRAME: +bfi: /* in case of a bad frame, just count and drop packt */ payload_type = 0; payload_len = 0; |