jyapayne/moonlight-common-c
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix the buffer data packets value being truncated on very large frames causing an out of bounds buffer access in reed_solomon_reconstruct()

Browse source
This commit is contained in:
Cameron Gutman 2017-06-06 02:07:13 -07:00
commit a499413221
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/RtpFecQueue.c
View file

@ -223,7 +223,7 @@ int RtpfAddPacket(PRTP_FEC_QUEUE queue, PRTP_PACKET packet, PRTPFEC_QUEUE_ENTRY
queue->bufferLowestSequenceNumber = ushort(packet->sequenceNumber - fecIndex);
queue->bufferSize = 0;
queue->bufferHighestSequenceNumber = packet->sequenceNumber;
queue->bufferDataPackets = ((nvPacket->fecInfo & 0xFF00000) >> 20) / 4;
queue->bufferDataPackets = ((nvPacket->fecInfo & 0xFFF00000) >> 20) / 4;
queue->fecPercentage = ((nvPacket->fecInfo & 0xFF0) >> 4);
} else if (isBefore(queue->bufferHighestSequenceNumber, packet->sequenceNumber)) {
queue->bufferHighestSequenceNumber = packet->sequenceNumber;