Skip to content

Conversation

maxsharabayko
Copy link
Collaborator

The documented length of SRTO_RCVBUF and SRTO_SNDBUF socket options is 4 bytes, the code was setting 8 bytes without checking optlen. Hence producing an out-of-bound memory write.

Introduced since the start by PR #1109.
Affected SRT versions: v1.4.2+.

Work within issue #3074.

The documented length is 4 bytes, the code was setting 8 bytes without checking `optlen`.
@maxsharabayko maxsharabayko added Type: Bug Indicates an unexpected problem or unintended behavior [core] Area: Changes in SRT library core labels Nov 19, 2024
@maxsharabayko maxsharabayko added this to the v1.5.5 milestone Nov 19, 2024
@maxsharabayko maxsharabayko merged commit 5f16494 into Haivision:master Nov 20, 2024
12 checks passed
@maxsharabayko maxsharabayko deleted the hotfix/group-srto-rcvbuf branch November 20, 2024 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[core] Area: Changes in SRT library core Type: Bug Indicates an unexpected problem or unintended behavior
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant