fix: toxav rtp temp buffer allocation size was too large

and cast from 32bit to 16bit, causing a overflow and making the allocated size too small
TokTok · Sep 17, 2024 · 2ed3990 · 2ed3990
1 parent d369c93
commit 2ed3990
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/toxav/rtp.c b/toxav/rtp.c
@@ -805,7 +805,7 @@ int rtp_send_data(RTPSession *session, const uint8_t *data, uint32_t length,
         header.flags |= RTP_KEY_FRAME;
     }
 
-    const uint16_t rdata_size = length + RTP_HEADER_SIZE + 1;
+    const uint16_t rdata_size = min_u32(length + RTP_HEADER_SIZE + 1, MAX_CRYPTO_DATA_SIZE);
     VLA(uint8_t, rdata, rdata_size);
     memset(rdata, 0, rdata_size);
     rdata[0] = session->payload_type;  // packet id == payload_type