[secdir] secdir review of draft-ietf-avt-rtp-ipmr-12.txt

[Juergen Schoenwaelder <[e-mail]>]

Hi.

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The document defines how SPIRIT IP-MR encoded speech signals can be
transported over RTP. The security considerations seem to be adequate.
However, I am concerned about the C code in the appendix extracting
frame information. The code does not seem to do proper bound checking,
which I think is a problem that needs to be fixed. I understand that
the frame size is an out parameter - still the size of the buffer
passed via pCoded should be available so that proper bound checking
can be performed.

Other than that, I noticed a number of editorial issues, mostly due to
missing articles etc. I am attaching a unified context diff correcting
some of the issues (but note that I stopped making changes at the end
of section 3 - so there is likely more to fix).

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>