Commit 567d6432 authored by Guillaume Roguez's avatar Guillaume Roguez Committed by Anthony Léonard

srtp: fix bad memory access

* fix non-initialized memory at SRTP session creation.
* fix invalid access when SRTP session is free in some conditions.

Change-Id: I95a1e2cd45b8007cb20445ca219f8e667e977656
Reviewed-by: default avatarAnthony Léonard <>
parent 52093687
......@@ -25,6 +25,7 @@
#include "ice_socket.h"
#include "libav_utils.h"
#include "logger.h"
#include "security/memory.h"
#include <iostream>
#include <string>
......@@ -69,6 +70,8 @@ class SRTPProtoContext {
SRTPProtoContext(const char* out_suite, const char* out_key,
const char* in_suite, const char* in_key) {
ring_secure_memzero(&srtp_out, sizeof(srtp_out));
ring_secure_memzero(&srtp_in, sizeof(srtp_in));
if (out_suite && out_key) {
// XXX: see srtp_open from libavformat/srtpproto.c
if (ff_srtp_set_crypto(&srtp_out, out_suite, out_key) < 0) {
......@@ -42,10 +42,14 @@ void ff_srtp_free(struct SRTPContext *s)
// aes and hmac have an opaque pointer type.
// No API to safely erase them, so just re-init with "dummy keys" to sanitize them
av_aes_init(s->aes, zero_buffer, 128, 0);
av_hmac_init(s->hmac, zero_buffer, sizeof(s->rtp_auth));
if (s->aes) {
av_aes_init(s->aes, zero_buffer, 128, 0);
if (s->hmac) {
av_hmac_init(s->hmac, zero_buffer, sizeof(s->rtp_auth));
ring_secure_memzero(s, sizeof(*s));
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment