From f38f4a65f930cb9776d638e1afa6aff2c3412f20 Mon Sep 17 00:00:00 2001
From: hecko <855807+hecko@users.noreply.github.com>
Date: Fri, 10 Jul 2026 03:29:22 +0000
Subject: [PATCH] AmRtpStream::recvDtmfPacket: ignore telephone-event packets
 with unexpected size

recvDtmfPacket casts the RTP payload to dtmf_payload_t* and reads
event/e/r/volume/duration without checking that the packet actually
carries a full 4-byte telephone-event payload. A truncated (1-3 byte)
telephone-event packet passes the non-empty-payload filter in receive()
and makes the cast read past the received data, producing bogus DTMF
events from stale buffer bytes.

Reject telephone-event packets whose data size is not exactly
sizeof(dtmf_payload_t). Backport of yeti-switch/sems a15aa819.
---
 core/AmRtpStream.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/AmRtpStream.cpp b/core/AmRtpStream.cpp
index 1b8e127be..b62d87547 100644
--- a/core/AmRtpStream.cpp
+++ b/core/AmRtpStream.cpp
@@ -855,6 +855,11 @@ bool AmRtpStream::getRemoteHold() {
 
 void AmRtpStream::recvDtmfPacket(AmRtpPacket* p) {
   if (p->payload == getLocalTelephoneEventPT()) {
+    // a telephone-event payload is exactly sizeof(dtmf_payload_t) bytes; a
+    // truncated packet would make the cast below read past the received data
+    // and yield bogus event/volume/duration values.
+    if (p->getDataSize() != sizeof(dtmf_payload_t))
+      return;
     dtmf_payload_t* dpl = (dtmf_payload_t*)p->getData();
 
     DBG("DTMF: event=%i; e=%i; r=%i; volume=%i; duration=%i; ts=%u session = [%p]\n",