mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-08-19 09:40:21 +00:00
Dmitry Verenitsin
a097e12421
`read_packet()` passed a peer-supplied `Content-Length` straight to `switch_zmalloc(body, clen + 1)`. Huge values drove `calloc` failure and `switch_zmalloc` `abort()`-ed the daemon. - Cap `Content-Length` at 16 MiB; reject negatives. - Destroy the partially-built `*event` at the new rejection site and at the existing body-recv failure path so callers don't leak it. - Add `test_mod_event_socket` covering `INT_MAX`, above-cap, negative, `atoi`-overflow, zero, and valid-non-zero-body cases.
12 lines
400 B
XML
12 lines
400 B
XML
<configuration name="event_socket.conf" description="Socket Client (test)">
|
|
<settings>
|
|
<param name="nat-map" value="false"/>
|
|
<param name="listen-ip" value="127.0.0.1"/>
|
|
<!--
|
|
Port 38021 chosen to avoid clashing with a default vanilla install on 8021.
|
|
-->
|
|
<param name="listen-port" value="38021"/>
|
|
<param name="password" value="ClueCon"/>
|
|
</settings>
|
|
</configuration>
|