Shannon Baseband fmtp SDP Attribute Memory Corruption

Shannon Baseband suffers from a memory corruption vulnerability that occurs when the baseband modem processes SDP when setting up a call. When an fmtp attribute is parsed, the integer that represents the payload type is copied into an 8-byte buffer using memcpy with the length of payload type as the length parameter. There are no checks that the payload type is less than 8-bytes long or actually an integer.

baseband buffer call corruption integer length memory memory corruption modem parameter payload processes sdp vulnerability