Dmitry Verenitsin
72cda5bfad
`rtmp_rtmp2rtpH264()` parses two kinds of inbound H.264 RTMP video messages: an AVC configuration record (`0x17/0x00`) that captures SPS/PPS, and NAL-unit messages (`0x17`/`0x27` with `0x01`). Both paths trusted wire-supplied sizes and counts without checking them against the bytes actually present, leading to out-of-bounds reads. NAL-unit walk: - The length-prefix walk advanced the cursor and decremented the unsigned remaining-byte counter by the wire NAL size with no check that the size fit. A NAL size larger than the remaining payload underflowed the counter to near `UINT32_MAX`, kept the loop running, and read the next size prefix from a cursor already past the end of the buffer. The initializer `pdata_len = len - 5` underflowed the same way for a message shorter than the 5-byte AVC header. - Reject `len < 5`, change the loop guard to `pdata_len > lenSize` so each size-prefix read stays in bounds, and reject any NAL whose declared size exceeds the bytes remaining after its prefix. AVC configuration record: - The fixed header fields (`configurationVersion`, `lengthSizeMinusOne`, `numOfSequenceParameterSets`) plus each 2-byte SPS/PPS length prefix and the PPS count byte were read with no minimum-length check. The existing per-entry checks bounded only the SPS/PPS body copies and ran after the length reads. - Reject `len < 11` before the fixed header, and add a remaining-bytes check before each `ntohs` length read and before the PPS count byte. Both changes are correctness-only: well-formed records and NAL streams hit none of the new guards. Malformed or truncated input is rejected with the existing "corrupted data" diagnostic.
FreeSWITCH
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. From a Raspberry PI to a multi-core server, FreeSWITCH can unlock the telecommunications potential of any device. Combined with our hosted cloud platform, SignalWire, FreeSWITCH can interconnect with the outside world and scale to any size.
Visit https://signalwire.com or https://github.com/signalwire for more info.
Getting Started
FreeSWITCH is available on Github in source code format. You can checkout the development branch and build for many popular platforms including Linux, Windows, MacOSX and BSD. There is an issue tracker and pull request system available as part of the repo online.
See https://developer.signalwire.com/freeswitch/FreeSWITCH-Explained/ for more detailed instructions.
Additional Help
If you need assistance or have an interest in using a commercially supported build, you can contact coreteam@freeswitch.com to learn about professional services to support your project.
Voice-over-IP services - SIP / SMS - App Integrations
SignalWire is the primary sponsor of the FreeSWITCH project and was founded by the original developers of FreeSWITCH. SignalWire provides scalable services to enhance and scale your project such as SMS, SIP, Serverless Application hosting as well as programmable telecom. mod_signalwire which is distributed in this code base allows you to instantly pair with SignalWire and extend your FreeSWITCH.
Documentation
The main index for documentation is available at:
Release notes:
Install from packages
Step by step tutorials to install FreeSWITCH from packages:
- Using FSGET [Recommended]
- Debian
- Raspberry Pi
- CentOS 7
Build from source
Example Dockerfiles to build FreeSWITCH and dependencies from source:
Step by step tutorials to build FreeSWITCH with provided dependency packages:
- Debian [Recommended]
- Raspberry Pi
- CentOS 7
How to build Debian packages
Downloads
Contributions
GitHub pull requests are the recommended way to contribute to the FreeSWITCH source code:
Community
Slack is our chat system where the developers, the FreeSWITCH team, and the most active users are present. This is the place to get answers faster and chat with other users in real time. All you need to do is enter your email and verify it on the Slack signup page and you are ready to join in the discussion!
Slack Community:
Mailing list (ARCHIVED):
Thank you for using FreeSWITCH!