diff options
author | Harald Welte <laforge@gnumonks.org> | 2015-12-28 21:03:10 +0100 |
---|---|---|
committer | Neels Hofmeyr <nhofmeyr@sysmocom.de> | 2016-03-03 16:19:07 +0100 |
commit | 8291623054abeb224f34584c2ecebf2b6c04ceae (patch) | |
tree | 0c7a8e8cd1cf355d1cca5451d2273f337a030adc /openbsc/src/libtrau/rtp_proxy.c | |
parent | 5331cf8dbdae6b29df50556c362462b973e93917 (diff) |
rtp_proxy.c: Ensure msgb_alloc is large enough for largest AMR frame
In AMR 12.2 (mode 7), the actual RTP payload is 33 bytes. Howeerver,
as we store the length of the (dynamically-sized) AMR payload in the
first byte, our buffer needs at least 33+1 byte in size.
Diffstat (limited to 'openbsc/src/libtrau/rtp_proxy.c')
-rw-r--r-- | openbsc/src/libtrau/rtp_proxy.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c index 8c982c976..6c0461017 100644 --- a/openbsc/src/libtrau/rtp_proxy.c +++ b/openbsc/src/libtrau/rtp_proxy.c @@ -172,7 +172,7 @@ static int rtp_decode(struct msgb *msg, uint32_t callref, struct msgb **data) /* always allocate for the maximum possible size to avoid * fragmentation */ new_msg = msgb_alloc(sizeof(struct gsm_data_frame) + - MAX_RTP_PAYLOAD_LEN, "GSM-DATA (TCH)"); + MAX_RTP_PAYLOAD_LEN+1, "GSM-DATA (TCH)"); if (!new_msg) return -ENOMEM; |