rtp_proxy.c: Ensure msgb_alloc is large enough for largest AMR frame
In AMR 12.2 (mode 7), the actual RTP payload is 33 bytes. Howeerver,
as we store the length of the (dynamically-sized) AMR payload in the
first byte, our buffer needs at least 33+1 byte in size.
Change-Id: If1ad5d2d68c85733306c75ea62f67fe8fbc143b3
Reviewed-on: https://gerrit.osmocom.org/91
Tested-by: Jenkins Builder
Reviewed-by: Harald Welte <laforge@gnumonks.org>
diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c
index 8c982c9..6c04610 100644
--- a/openbsc/src/libtrau/rtp_proxy.c
+++ b/openbsc/src/libtrau/rtp_proxy.c
@@ -172,7 +172,7 @@
/* always allocate for the maximum possible size to avoid
* fragmentation */
new_msg = msgb_alloc(sizeof(struct gsm_data_frame) +
- MAX_RTP_PAYLOAD_LEN, "GSM-DATA (TCH)");
+ MAX_RTP_PAYLOAD_LEN+1, "GSM-DATA (TCH)");
if (!new_msg)
return -ENOMEM;