rtmppkt: Check for packet size mismatches

When receiving fragmented packets, the first packet declares the size,
and the later ones normally are small follow-on packets that don't repeat
the size and the other header fields. But technically, the later fragments
also can have a full header, declaring a different size than the previous
packet.

If the follow-on packet declares a larger size than the initial one, we
could end up writing outside of the allocation.

This fixes out of bounds writes.

Found-by: Paul Cher <[email protected]>
Reviewed-by: Paul Cher <[email protected]>

CC: [email protected]
Signed-off-by: Martin Storsjö <[email protected]>

0 files changed, 0 insertions, 0 deletions