]> git.sesse.net Git - vlc/commitdiff
SRTP: integer overflow
authorRémi Denis-Courmont <remi@remlab.net>
Sat, 15 Nov 2014 10:49:22 +0000 (12:49 +0200)
committerRémi Denis-Courmont <remi@remlab.net>
Sat, 15 Nov 2014 10:49:22 +0000 (12:49 +0200)
modules/access/rtp/srtp.c

index 9447f34d12d06cfa39520d3b535d0725413e6d50..883e553396518390af120fc9c893c5b44fa0205f 100644 (file)
@@ -738,7 +738,7 @@ static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
     {
         /* Packet in the future, good */
         s->rtcp.window = s->rtcp.window << diff;
-        s->rtcp.window |= 1;
+        s->rtcp.window |= UINT64_C(1);
         s->rtcp_index = index;
     }
     else
@@ -747,7 +747,7 @@ static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
         diff = -diff;
         if ((diff >= 64) || ((s->rtcp.window >> diff) & 1))
             return EACCES; // replay attack!
-        s->rtp.window |= 1 << diff;
+        s->rtp.window |= UINT64_C(1) << diff;
     }
 
     /* Crypts SRTCP */