]> git.sesse.net Git - vlc/commitdiff
SRTP: integer overflow
authorRémi Denis-Courmont <remi@remlab.net>
Sat, 15 Nov 2014 10:47:29 +0000 (12:47 +0200)
committerRémi Denis-Courmont <remi@remlab.net>
Sat, 15 Nov 2014 10:47:29 +0000 (12:47 +0200)
modules/access/rtp/srtp.c

index 1f8de38d918231e7c58b80661f9add1f548ed315..9447f34d12d06cfa39520d3b535d0725413e6d50 100644 (file)
@@ -496,7 +496,7 @@ static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
     {
         /* Sequence in the future, good */
         s->rtp.window = s->rtp.window << diff;
-        s->rtp.window |= 1;
+        s->rtp.window |= UINT64_C(1);
         s->rtp_seq = seq, s->rtp_roc = roc;
     }
     else
@@ -505,7 +505,7 @@ static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
         diff = -diff;
         if ((diff >= 64) || ((s->rtp.window >> diff) & 1))
             return EACCES; /* Replay attack */
-        s->rtp.window |= 1 << diff;
+        s->rtp.window |= UINT64_C(1) << diff;
     }
 
     /* Encrypt/Decrypt */