From c4ec84d3981468d4c5c5c144ea4fba916202016c Mon Sep 17 00:00:00 2001 From: Gregor Fabritius Date: Sun, 15 Jul 2012 23:10:28 +0200 Subject: [PATCH] Fixed Issue #147: Segfaults on ShairPort version 0.05 C port When requesting resend of packets a lot, iOS sometimes sends a packet with type 0x56 (Reply to resend request), but with sequence number 0 and length == 4. This short length leads to memory corruption later on when processing the packet: alac_decode() expects at least 16 bytes for AES IV. Therefore the segfault. This fix ignores packets with length < 16, as seen in another implementation here: http://fossies.org/dox/mythtv-0.25.1/mythraopconnection_8cpp_source.html#l00555 Please be aware that this just fixes the segfault. The suspicious packet seems to be an information of an out of sync situation, so it may deserve further attention. Signed-off-by: Gregor Fabritius --- hairtunes.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/hairtunes.c b/hairtunes.c index 6859cffd..3f83f19f 100644 --- a/hairtunes.c +++ b/hairtunes.c @@ -445,7 +445,16 @@ static void *rtp_thread_func(void *arg) { plen -= 4; } seqno = ntohs(*(unsigned short *)(pktp+2)); - buffer_put_packet(seqno, pktp+12, plen-12); + + // adjust pointer and length + pktp += 12; + plen -= 12; + + // check if packet contains enough content to be reasonable + if (plen < 16) + continue; + + buffer_put_packet(seqno, pktp, plen); } }