kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

bounds check length passed to memcpy. 

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@6846 d0543943-73ff-0310-b7d9-9358b9ac24b2
This commit is contained in:
Michael Jerris 2007-12-17 23:43:15 +00:00
parent 304d5004a6
commit 6683db6581
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/switch_rtp.c
View File

@ -215,8 +215,13 @@ static void handle_ice(switch_rtp_t *rtp_session, void *data, switch_size_t len)
switch_stun_packet_attribute_t *attr; switch_stun_packet_attribute_t *attr;
char username[33] = { 0 }; char username[33] = { 0 };
unsigned char buf[512] = { 0 }; unsigned char buf[512] = { 0 };
switch_size_t cpylen = len;
if (cpylen > 512) {
cpylen = 512;
}
memcpy(buf, data, len); memcpy(buf, data, cpylen);
packet = switch_stun_packet_parse(buf, sizeof(buf)); packet = switch_stun_packet_parse(buf, sizeof(buf));
rtp_session->last_stun = switch_time_now(); rtp_session->last_stun = switch_time_now();
@ -1651,6 +1656,10 @@ SWITCH_DECLARE(int) switch_rtp_write_manual(switch_rtp_t *rtp_session,
return -1; return -1;
} }
if (datalen > SWITCH_RTP_MAX_BUF_LEN) {
return -1;
}
send_msg = rtp_session->send_msg; send_msg = rtp_session->send_msg;
send_msg.header.seq = htons(mseq); send_msg.header.seq = htons(mseq);
send_msg.header.ts = htonl(ts); send_msg.header.ts = htonl(ts);