MT#55283 fix array out of bounds access

The PT index can be -1 or -2. Ignore RTP stats in this case. fixes #1814 Change-Id: Ifdcdbccad592fd1a27d2b31359861ecb3e725546
sipwise · Apr 5, 2024 · 3876bdd · 3876bdd
1 parent f695e77
commit 3876bdd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c
@@ -5310,7 +5310,7 @@ static unsigned int rtpengine46(struct sk_buff *skb, struct sk_buff *oskb,
 
 		skb_trim(skb, rtp.header_len + rtp.payload_len);
 
-		if (g->target.rtp_stats && ssrc_idx != -1)
+		if (g->target.rtp_stats && ssrc_idx != -1 && rtp_pt_idx >= 0)
 			rtp_stats(g, &rtp, ktime_to_us(skb->tstamp), rtp_pt_idx, ssrc_idx);
 
 		DBG("packet payload decrypted as %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x...\n",