Fix incorrectly masked seq number for GCM IV.

srtp/srtp.c

 /*
  * srtp.c
  *
  * the secure real-time transport protocol
  *
  * David A. McGrew
  * Cisco Systems, Inc.
  */
 /*
  *      
@@ skipping 2843 matching lines @@
  *               +--+--+--+--+--+--+--+--+--+--+--+--+   |
  *               |       Initialization Vector       |<--+
  *               +--+--+--+--+--+--+--+--+--+--+--+--+*
  *
  * Input:  *stream - pointer to SRTP stream context, used to retrieve
  *                   the SALT 
  *         *iv     - Pointer to recieve the calculated IV
  *         seq_num - The SEQ value to use for the IV calculation.
  *         *hdr    - The RTP header, used to get the SSRC value
  *
+ * Returns: srtp_err_status_ok if no error or srtp_err_status_bad_param
+ *          if seq_num is invalid
+ *
  */
-static void srtp_calc_aead_iv_srtcp(srtp_stream_ctx_t *stream, v128_t *iv, 
-                                    uint32_t seq_num, srtcp_hdr_t *hdr)
+static srtp_err_status_t
+srtp_calc_aead_iv_srtcp(srtp_stream_ctx_t *stream, v128_t *iv,
+                        uint32_t seq_num, srtcp_hdr_t *hdr)
 {
     v128_t      in;
     v128_t      salt;
 
     memset(&in, 0, sizeof(v128_t));
     memset(&salt, 0, sizeof(v128_t));
 
     in.v16[0] = 0;
     memcpy(&in.v16[1], &hdr->ssrc, 4); /* still in network order! */
     in.v16[3] = 0;
-    in.v32[2] = 0x7FFFFFFF & htonl(seq_num); /* bit 32 is suppose to be zero */
+
+    /*
+     *  The SRTCP index (seq_num) spans bits 0 through 30 inclusive.
+     *  The most significant bit should be zero.
+     */
+    if (seq_num & 0x80000000UL) {
+        return srtp_err_status_bad_param;
+    }
+    in.v32[2] = htonl(seq_num);
 
     debug_print(mod_srtp, "Pre-salted RTCP IV = %s\n", v128_hex_string(&in));
 
     /*
      * Get the SALT value from the context
      */
     memcpy(salt.v8, stream->c_salt, 12);
     debug_print(mod_srtp, "RTCP SALT = %s\n", v128_hex_string(&salt));
 
     /*
      * Finally, apply the SALT to the input
      */
     v128_xor(iv, &in, &salt);
+
+    return srtp_err_status_ok;
 }
 
 /*
  * This code handles AEAD ciphers for outgoing RTCP.  We currently support
  * AES-GCM mode with 128 or 256 bit keys. 
  */
 static srtp_err_status_t
 srtp_protect_rtcp_aead (srtp_t ctx, srtp_stream_ctx_t *stream, 
                         void *rtcp_hdr, unsigned int *pkt_octet_len)
 {
@@ skipping 47 matching lines @@
      */
     status = srtp_rdb_increment(&stream->rtcp_rdb);
     if (status) {
         return status;
     }
     seq_num = srtp_rdb_get_value(&stream->rtcp_rdb);
     *trailer |= htonl(seq_num);
     debug_print(mod_srtp, "srtcp index: %x", seq_num);
 
     /*
-     * Calculating the IV and pass it down to the cipher 
+     * Calculate and set the IV
      */
-    srtp_calc_aead_iv_srtcp(stream, &iv, seq_num, hdr);
+    status = srtp_calc_aead_iv_srtcp(stream, &iv, seq_num, hdr);
+    if (status) {
+        return srtp_err_status_cipher_fail;
+    }
     status = srtp_cipher_set_iv(stream->rtcp_cipher, (uint8_t*)&iv, srtp_direction_encrypt);
     if (status) {
         return srtp_err_status_cipher_fail;
     }
 
     /*
      * Set the AAD for GCM mode
      */
     if (enc_start) {
         /*
@@ skipping 124 matching lines @@
     seq_num = ntohl(*trailer) & SRTCP_INDEX_MASK;
     debug_print(mod_srtp, "srtcp index: %x", seq_num);
     status = srtp_rdb_check(&stream->rtcp_rdb, seq_num);
     if (status) {
         return status;
     }
 
     /*
      * Calculate and set the IV
      */
-    srtp_calc_aead_iv_srtcp(stream, &iv, seq_num, hdr);
+    status = srtp_calc_aead_iv_srtcp(stream, &iv, seq_num, hdr);
+    if (status) {
+        return srtp_err_status_cipher_fail;
+    }
     status = srtp_cipher_set_iv(stream->rtcp_cipher, (uint8_t*)&iv, srtp_direction_decrypt);
     if (status) {
         return srtp_err_status_cipher_fail;
     }
 
     /*
      * Set the AAD for GCM mode
      */
     if (enc_start) {
         /*
@@ skipping 711 matching lines @@
 srtp_err_status_t srtp_set_debug_module(char *mod_name, int v)
 {
     return srtp_crypto_kernel_set_debug_module(mod_name, v);
 }
 
 srtp_err_status_t srtp_list_debug_modules(void)
 {
     return srtp_crypto_kernel_list_debug_modules();
 }