mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-10-09 21:14:02 +00:00
Merge commit from fork
`read_packet()` passed a peer-supplied `Content-Length` straight to `switch_zmalloc(body, clen + 1)`. Huge values drove `calloc` failure and `switch_zmalloc` `abort()`-ed the daemon. - Cap `Content-Length` at 16 MiB; reject negatives. - Destroy the partially-built `*event` at the new rejection site and at the existing body-recv failure path so callers don't leak it. - Add `test_mod_event_socket` covering `INT_MAX`, above-cap, negative, `atoi`-overflow, zero, and valid-non-zero-body cases.
This commit is contained in:
@@ -7,6 +7,7 @@ noinst_PROGRAMS += switch_stun
|
||||
noinst_PROGRAMS += test_tts_format
|
||||
noinst_PROGRAMS+= switch_hold switch_sip
|
||||
noinst_PROGRAMS += test_mod_verto
|
||||
noinst_PROGRAMS += test_mod_event_socket
|
||||
|
||||
if HAVE_PCAP
|
||||
noinst_PROGRAMS += switch_rtp_pcap
|
||||
|
||||
Reference in New Issue
Block a user