rohc

decompressor: zero-length packet causes a crash

Bug #1087682 reported by Didier Barvaux on 2012-12-07

6

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	rohc	Status tracked in Rohc-main
	1.3.x	Fix Released	Critical	Didier Barvaux	rohc 1.3.4
	1.4.x	Fix Released	Critical	Didier Barvaux	rohc 1.4.2
	Rohc-1.5.x	Fix Released	Critical	Didier Barvaux	rohc 1.5.1
	Rohc-main	Fix Released	Critical	Didier Barvaux	rohc 1.6.0

Bug Description

Decompressing a zero-length ROHC packet makes the ROHC library crash.

Tags:

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#1

Fixed in main branch: sanitize inputs of the rohc_decompress() function.

See http://bazaar.launchpad.net/~didier-barvaux/rohc/main/revision/615

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#2

Fixed on 1.5.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.5.x/revision/536

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#3

Fixed on 1.4.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.4.x/revision/352

Revision history for this message

Didier Barvaux (didier-barvaux) wrote on 2012-12-07:

#4

Fixed on 1.3.x branch. See http://bazaar.launchpad.net/~didier-barvaux/rohc/1.3.x/revision/205

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.