ASVS 5.0 V17.2.4 requires that the media server can keep processing incoming media when it meets malformed SRTP packets. It is a Level 2 requirement.
A bad packet should be counted and dropped. It should not crash the process, stall a thread or damage other calls.
Why it matters
The media port faces the internet and parses binary data before any application logic runs. A length field read without a bounds check, an unexpected header extension or a truncated packet can crash a native parser. One packet then ends every active call on that server.
How to implement it
- Validate lengths before copying: the packet must be at least the minimum RTP header size, the CSRC count and extension length must fit inside the buffer, and the payload size must be sane.
- Use memory safe code for new parsers where you can, and keep native libraries patched.
- Handle each packet in an isolated error path that drops and continues.
- Run the media process under a supervisor, and consider one process per room so a crash has a small blast radius.
- Build with sanitizers (AddressSanitizer) in test builds.
def parse_rtp(buf: bytes):
if len(buf) < 12 or (buf[0] >> 6) != 2:
return None
cc = buf[0] & 0x0F
offset = 12 + 4 * cc
if len(buf) < offset:
return None
return buf[offset:]
How to test it
Fuzz the UDP media port with random and mutated packets (truncated headers, huge extension lengths, wrong version bits) while a call runs. Pass: the call audio stays continuous, the process does not restart, and malformed packet counters increase. Run a fuzzer such as AFL++ or libFuzzer against the parser in CI.
Process isolation
Even careful code has bugs, so design for the crash. Isolating each room or each group of rooms in its own worker limits the damage. A supervisor restarts the worker and clients reconnect through ICE restart. Combine that with a canary deployment, so a new parser change that crashes on real traffic affects a small share of calls first.
Common mistakes
- Trusting the length fields in the packet.
- Handling parse errors by throwing out of the receive loop.
- Never fuzzing, because "it is a well known library".
Quick check
What should happen to a malformed packet?
Drop it, count it, keep serving. No crash, no log flood, no effect on other streams.
