Update libsrtp to upstream commit be95365fbb4788b688cab7af61c65b7989055fb4

srtp/srtp/srtp.c

 /*
  * srtp.c
  *
  * the secure real-time transport protocol
  *
  * David A. McGrew
  * Cisco Systems, Inc.
  */
 /*
  *      
@@ skipping 1059 matching lines @@
      * find starting point for decryption and length of data to be
      * decrypted - the encrypted portion starts after the rtp header
      * extension, if present; otherwise, it starts after the last csrc,
      * if any are present
      */
     enc_start = (uint32_t*)hdr + uint32s_in_rtp_header + hdr->cc;
     if (hdr->x == 1) {
         srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t*)enc_start;
         enc_start += (ntohs(xtn_hdr->length) + 1);
     }
-    if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
+    if (!((uint8_t*)enc_start < (uint8_t*)hdr + (*pkt_octet_len - tag_len)))
         return err_status_parse_err;
     /*
      * We pass the tag down to the cipher when doing GCM mode 
      */
     enc_octet_len = (unsigned int)(*pkt_octet_len - 
                                    ((uint8_t*)enc_start - (uint8_t*)hdr));
 
     /*
      * Sanity check the encrypted payload length against
      * the tag size.  It must always be at least as large
@@ skipping 209 matching lines @@
     * extension, if present; otherwise, it starts after the last csrc,
     * if any are present
     *
     * if we're not providing confidentiality, set enc_start to NULL
     */
    if (stream->rtp_services & sec_serv_conf) {
      enc_start = (uint32_t *)hdr + uint32s_in_rtp_header + hdr->cc;  
      if (hdr->x == 1) {
        srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t *)enc_start;
        enc_start += (ntohs(xtn_hdr->length) + 1);
-       if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
-         return err_status_parse_err;
      }
+     if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
+       return err_status_parse_err;
      enc_octet_len = (unsigned int)(*pkt_octet_len -
                                     ((uint8_t*)enc_start - (uint8_t*)hdr));
    } else {
      enc_start = NULL;
    }
 
    /* 
     * if we're providing authentication, set the auth_start and auth_tag
     * pointers to the proper locations; otherwise, set auth_start to NULL
     * to indicate that no authentication is needed
@@ skipping 265 matching lines @@
    * if any are present
    *
    * if we're not providing confidentiality, set enc_start to NULL
    */
   if (stream->rtp_services & sec_serv_conf) {
     enc_start = (uint32_t *)hdr + uint32s_in_rtp_header + hdr->cc;  
     if (hdr->x == 1) {
       srtp_hdr_xtnd_t *xtn_hdr = (srtp_hdr_xtnd_t *)enc_start;
       enc_start += (ntohs(xtn_hdr->length) + 1);
     }  
-    if (!((uint8_t*)enc_start < (uint8_t*)hdr + *pkt_octet_len))
+    if (!((uint8_t*)enc_start < (uint8_t*)hdr + (*pkt_octet_len - tag_len)))
       return err_status_parse_err;
     enc_octet_len = (uint32_t)(*pkt_octet_len - tag_len -
                                ((uint8_t*)enc_start - (uint8_t*)hdr));
   } else {
     enc_start = NULL;
   }
 
   /* 
    * if we're providing authentication, set the auth_start and auth_tag
    * pointers to the proper locations; otherwise, set auth_start to NULL
@@ skipping 1607 matching lines @@
     break;
   case srtp_profile_aes256_cm_sha1_32:
     return 14;
     break;
     /* the following profiles are not (yet) supported */
   case srtp_profile_null_sha1_32:
   default:
     return 0;  /* indicate error by returning a zero */
   }
 }