From 6683db6581f29c7d2d4074e649239c9e5a5f96b4 Mon Sep 17 00:00:00 2001 From: Michael Jerris Date: Mon, 17 Dec 2007 23:43:15 +0000 Subject: [PATCH] bounds check length passed to memcpy. git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@6846 d0543943-73ff-0310-b7d9-9358b9ac24b2 --- src/switch_rtp.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/switch_rtp.c b/src/switch_rtp.c index 521025a446..9447f1bc78 100644 --- a/src/switch_rtp.c +++ b/src/switch_rtp.c @@ -215,8 +215,13 @@ static void handle_ice(switch_rtp_t *rtp_session, void *data, switch_size_t len) switch_stun_packet_attribute_t *attr; char username[33] = { 0 }; unsigned char buf[512] = { 0 }; + switch_size_t cpylen = len; + + if (cpylen > 512) { + cpylen = 512; + } - memcpy(buf, data, len); + memcpy(buf, data, cpylen); packet = switch_stun_packet_parse(buf, sizeof(buf)); rtp_session->last_stun = switch_time_now(); @@ -1651,6 +1656,10 @@ SWITCH_DECLARE(int) switch_rtp_write_manual(switch_rtp_t *rtp_session, return -1; } + if (datalen > SWITCH_RTP_MAX_BUF_LEN) { + return -1; + } + send_msg = rtp_session->send_msg; send_msg.header.seq = htons(mseq); send_msg.header.ts = htonl(ts);