[Freeswitch-users] Invalid length field in RTCP Sender Report

[James Bravo]

Hi

We've had a number of Yealink T22 & T28 phones with later
firmware crashing within approx 30 seconds of sending
and receiving RTP.
Yealink R&D department have narrowed it down to a
non-standard RTCP 'Sender Report' packet from FreeSWITCH.
For some packet content, the length field in these packets
does not seem to agree with the overall UDP packet size.
RFC1889 defines the length as:
     "The length of this RTCP packet in 32-bit words minus one,
     including the header and any padding."
For instance, below is a RTCP packet sent from FS as viewed
in Wireshark. The length field says 76 bytes but the udp packet
length is 78 bytes so the last two bytes (0x31, 0x00) are excluded
as far as the length field is concerned.


I managed to stop the phones crashing by changing the following lines
in switch_rtp.c...
         rtcp_bytes = sizeof(switch_rtcp_hdr_t) + sizeof(struct 
switch_rtcp_senderinfo) + sr->sr_desc_ssrc.length -1 ;
         rtp_session->rtcp_send_msg.header.length = 
htons((u_short)(rtcp_bytes / 4) - 1);
...to something like...
     {
         switch_size_t rtcp_bytes_mod4;
         rtcp_bytes = sizeof(switch_rtcp_hdr_t) + sizeof(struct 
switch_rtcp_senderinfo) + sr->sr_desc_ssrc.length -1 ;
         // Add padding and adjust length if necessary
         rtcp_bytes_mod4 = rtcp_bytes % 4;
         if (rtcp_bytes_mod4 > 0)
             rtcp_bytes += 4 - rtcp_bytes_mod4;
         rtp_session->rtcp_send_msg.header.length = 
htons((u_short)(rtcp_bytes / 4 - 1));
     }
although Freeswitch developers will probably find a better solution.

Thanks in advance,
James Bravo,
Redmatter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20120924/56bb779c/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: aihejhbj.png
Type: image/png
Size: 154943 bytes
Desc: not available
Url : http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20120924/56bb779c/attachment-0001.png