From bc3af7e7aadb33cb0940e50fa270a165192a06bc Mon Sep 17 00:00:00 2001
From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= <rdenis@simphalempin.com>
Date: Sun, 15 Jun 2008 22:40:33 +0300
Subject: [PATCH] SRTP: check buffer length before sequence

---
 libs/srtp/srtp.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/libs/srtp/srtp.c b/libs/srtp/srtp.c
index dcde338eaa..ec49101494 100644
--- a/libs/srtp/srtp.c
+++ b/libs/srtp/srtp.c
@@ -600,17 +600,21 @@ int
 srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
 {
     size_t len = *lenp;
-    int val = srtp_crypt (s, buf, len);
-    if (val)
-        return val;
+    size_t tag_len = s->tag_len;
 
     if (!(s->flags & SRTP_UNAUTHENTICATED))
     {
-        size_t tag_len = s->tag_len;
         *lenp = len + tag_len;
         if (bufsize < (len + tag_len))
             return ENOSPC;
+    }
+
+    int val = srtp_crypt (s, buf, len);
+    if (val)
+        return val;
 
+    if (!(s->flags & SRTP_UNAUTHENTICATED))
+    {
         uint32_t roc = srtp_compute_roc (s, rtp_seq (buf));
         const uint8_t *tag = rtp_digest (s, buf, len, roc);
         if (rcc_mode (s))
-- 
2.39.2