From 905703c9070387bf20d9b5c81f7611cf85b8ca68 Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Wed, 28 Jun 2017 11:32:24 -0500 Subject: [PATCH] FS-10394: [freeswitch-core] FS Crash while linphone sends ICE packets --- src/switch_stun.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/switch_stun.c b/src/switch_stun.c index 1d10d809cf..6573d3eceb 100644 --- a/src/switch_stun.c +++ b/src/switch_stun.c @@ -216,7 +216,7 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui alen = switch_stun_attribute_padded_length(attr); - if (alen > (int)bytes_left || alen <= 0) { + if (alen > (int)bytes_left || alen < 0) { /* * Note we simply don't "break" here out of the loop anymore because * we don't want the upper layers to have to deal with attributes without a value @@ -330,6 +330,9 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui } bytes_left -= alen; /* attribute value consumed, substract padded length */ + + if (alen == 0) break; + xlen += 4 + alen; attr = (switch_stun_packet_attribute_t *) (attr->value + alen);