There is a buffer overflow in libsrtp based on how the function crypto_policy_set_from_profile_for_rtp applies the cryptographic profiles srtp_profile_aes128_cm_sha1_32/srtp_profile_aes256_cm_sha1_32 to a srtp_policy, as shown by the source code of srtp/srtp.c.
112bf3ad2eda5bcd6a0c1e1ed5ede49353a25cf04adb02ff4b6303ee26c6fef2