From c4ec84d3981468d4c5c5c144ea4fba916202016c Mon Sep 17 00:00:00 2001 From: Gregor Fabritius Date: Sun, 15 Jul 2012 23:10:28 +0200 Subject: [PATCH 1/2] Fixed Issue #147: Segfaults on ShairPort version 0.05 C port When requesting resend of packets a lot, iOS sometimes sends a packet with type 0x56 (Reply to resend request), but with sequence number 0 and length == 4. This short length leads to memory corruption later on when processing the packet: alac_decode() expects at least 16 bytes for AES IV. Therefore the segfault. This fix ignores packets with length < 16, as seen in another implementation here: http://fossies.org/dox/mythtv-0.25.1/mythraopconnection_8cpp_source.html#l00555 Please be aware that this just fixes the segfault. The suspicious packet seems to be an information of an out of sync situation, so it may deserve further attention. Signed-off-by: Gregor Fabritius --- hairtunes.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/hairtunes.c b/hairtunes.c index 6859cffd..3f83f19f 100644 --- a/hairtunes.c +++ b/hairtunes.c @@ -445,7 +445,16 @@ static void *rtp_thread_func(void *arg) { plen -= 4; } seqno = ntohs(*(unsigned short *)(pktp+2)); - buffer_put_packet(seqno, pktp+12, plen-12); + + // adjust pointer and length + pktp += 12; + plen -= 12; + + // check if packet contains enough content to be reasonable + if (plen < 16) + continue; + + buffer_put_packet(seqno, pktp, plen); } } From 643f57d52b4dda4a370cad7213d32f51ced212a8 Mon Sep 17 00:00:00 2001 From: Gregor Fabritius Date: Mon, 16 Jul 2012 01:27:08 +0200 Subject: [PATCH 2/2] Initiating resync when receiving strange packet The packet type 0x56, sequence number 0, containing 4 bytes (the first two are the sequence number of the previously requested packet) initiates a resync. Not sure what this packet is supposed to do, but it occurs after heavy requesting resending of packets. Seems to be an out of sync situation, so resyncing is not the worst idea. Signed-off-by: Gregor Fabritius --- hairtunes.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/hairtunes.c b/hairtunes.c index 3f83f19f..5671c665 100644 --- a/hairtunes.c +++ b/hairtunes.c @@ -451,10 +451,17 @@ static void *rtp_thread_func(void *arg) { plen -= 12; // check if packet contains enough content to be reasonable - if (plen < 16) - continue; - - buffer_put_packet(seqno, pktp, plen); + if (plen >= 16) { + buffer_put_packet(seqno, pktp, plen); + } else { + // resync? + if (type == 0x56 && seqno == 0) { + fprintf(stderr, "Suspected resync request packet received. Initiating resync.\n"); + pthread_mutex_lock(&ab_mutex); + ab_resync(); + pthread_mutex_unlock(&ab_mutex); + } + } } }