RTP_EncDec: avoid crashes caused by invalid RTP packets

The function f__RTP__dec accepts data (RTP packet) of arbitrary length, but it also accesses regions of the RTP header using fixed indexes. In case the RTP packet is shorter than those indexes, a segmentation failt occurs. This can be avoided by checking if the incoming RTP packet has at least a minimum size of 12 bytes. In this case we would return an empty ret_val.

src/RTP_EncDec.cc

@@ -33,9 +33,19 @@ OCTETSTRING f__RTP__enc(RTP__messages__union const &pdu){
 RTP__messages__union f__RTP__dec(OCTETSTRING const &data){
   const unsigned char *raw_data=(const unsigned char*)data;
   int data_length=data.lengthof();
-  int pt=raw_data[1]&0x7f;
+  int pt;
   RTP__messages__union ret_val;
   TTCN_Buffer bb;
+
+  // A valid RTP packet must have at least 12  header header bytes. Shorter
+  // packets cannot be valid, so we return an an RTP__messages__union that
+  // just reflects the raw packet as unknown_pdu. See rfc3550 5.1.
+  if (data_length < 12) {
+    ret_val.unknown__pdu()=OCTETSTRING(data_length,raw_data);
+    return ret_val;
+  }
+
+  pt=raw_data[1]&0x7f;
   if(raw_data[0]&0x20){
     data_length-=raw_data[data_length-1];
   }