Fix crash when FCD frame has bad length but CRC is OK.

coppice-git commented 2 years ago

That fix is silently ignoring the reception of a good (i.e. the CRC is OK) frame with bad contents, which should not happen. A better fix is something like:

if (len < 4)
{
    span_log(&s->logging, SPAN_LOG_FLOW, "Bad length for FCD frame - %d\n", len);
    /* This frame didn't get corrupted in transit, because its CRC is OK. It was sent bad
       and there is little possibility that causing a retransmission will help. It is best
       to just give up. */
    t30_set_status(s, T30_ERR_TX_ECMPHD);
    terminate_call(s);
    return;
}
/*endif*/

at the start of process_rx_fcd(), to record that the erroneous from was received, and handle it similarly to other bad frames

dragos-oancea commented 2 years ago

the fix is for: https://github.com/freeswitch/spandsp/issues/38 . it's more like a "hotfix". we will try your approach.

andywolk commented 2 years ago

@coppice-git Can you please formally approve the change Dragos did?

freeswitch / spandsp

Fix crash when FCD frame has bad length but CRC is OK. #39