kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

FS-11711: fix overflow on reading ICE candidates (found with ASAN)

This commit is contained in:
Dragos Oancea 2019-03-20 18:14:28 +00:00 committed by Mike Jerris
parent 90ea0b7a1f
commit c82f093419
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/switch_core_media.c
View File

@ -4105,7 +4105,7 @@ static switch_status_t check_ice(switch_media_handle_t *smh, switch_media_type_t
for (attr_idx = 0; attr_idx < 2 && !(ice_seen && cand_seen); attr_idx++) { for (attr_idx = 0; attr_idx < 2 && !(ice_seen && cand_seen); attr_idx++) {
for (attr = attrs[attr_idx]; attr; attr = attr->a_next) { for (attr = attrs[attr_idx]; attr; attr = attr->a_next) {
char *data; char *data;
char *fields[15]; char *fields[32] = {0};
int argc = 0, j = 0; int argc = 0, j = 0;
if (zstr(attr->a_name)) { if (zstr(attr->a_name)) {
@ -4220,13 +4220,13 @@ static switch_status_t check_ice(switch_media_handle_t *smh, switch_media_type_t
switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(smh->session), SWITCH_LOG_DEBUG, switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(smh->session), SWITCH_LOG_DEBUG,
"Drop %s Candidate cid: %d proto: %s type: %s addr: %s:%s (no network path)\n", "Drop %s Candidate cid: %d proto: %s type: %s addr: %s:%s (no network path)\n",
type == SWITCH_MEDIA_TYPE_VIDEO ? "video" : "audio", type == SWITCH_MEDIA_TYPE_VIDEO ? "video" : "audio",
cid+1, fields[2], fields[7], fields[4], fields[5]); cid+1, fields[2], fields[7] ? fields[7] : "N/A", fields[4], fields[5]);
continue; continue;
} else { } else {
switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(smh->session), SWITCH_LOG_DEBUG, switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(smh->session), SWITCH_LOG_DEBUG,
"Save %s Candidate cid: %d proto: %s type: %s addr: %s:%s\n", "Save %s Candidate cid: %d proto: %s type: %s addr: %s:%s\n",
type == SWITCH_MEDIA_TYPE_VIDEO ? "video" : "audio", type == SWITCH_MEDIA_TYPE_VIDEO ? "video" : "audio",
cid+1, fields[2], fields[7], fields[4], fields[5]); cid+1, fields[2], fields[7] ? fields[7] : "N/A", fields[4], fields[5]);
} }
@ -4239,7 +4239,7 @@ static switch_status_t check_ice(switch_media_handle_t *smh, switch_media_type_t
j = 6; j = 6;
while(j < argc && fields[j+1]) { while(j < argc && j <= sizeof(fields)/sizeof(char*) && fields[j+1] && engine->ice_in.cand_idx[cid] < MAX_CAND - 1) {
if (!strcasecmp(fields[j], "typ")) { if (!strcasecmp(fields[j], "typ")) {
engine->ice_in.cands[engine->ice_in.cand_idx[cid]][cid].cand_type = switch_core_session_strdup(smh->session, fields[j+1]); engine->ice_in.cands[engine->ice_in.cand_idx[cid]][cid].cand_type = switch_core_session_strdup(smh->session, fields[j+1]);
} else if (!strcasecmp(fields[j], "raddr")) { } else if (!strcasecmp(fields[j], "raddr")) {