Changeset 1150 for pjproject

Timestamp:

Apr 4, 2007 5:29:36 PM (18 years ago)

Author:

bennylp

Message:

Fixed crash with invalid PDU and added MAGIC-COOKIE attribute for backward compatibility with old TURN

Location:

pjproject/trunk/pjnath

Files:

• include/pjnath/stun_msg.h (modified) (1 diff)
• src/pjnath/errno.c (modified) (2 diffs)
• src/pjnath/stun_msg.c (modified) (4 diffs)
• src/pjstun-client/client_main.c (modified) (1 diff)

pjproject/trunk/pjnath/include/pjnath/stun_msg.h

@@ -286 +286 @@
     PJ_STUN_ATTR_REFLECTED_FROM     = 0x000B,/**< REFLECTED-FROM (deprecatd)*/
     PJ_STUN_ATTR_LIFETIME           = 0x000D,/**< LIFETIME attribute.       */
+    PJ_STUN_ATTR_MAGIC_COOKIE       = 0x000F,/**< MAGIC-COOKIE attr (deprec)*/
     PJ_STUN_ATTR_BANDWIDTH          = 0x0010,/**< BANDWIDTH attribute       */
     PJ_STUN_ATTR_REMOTE_ADDR        = 0x0012,/**< REMOTE-ADDRESS attribute  */

pjproject/trunk/pjnath/src/pjnath/errno.c

@@ -135 +135 @@
     pj_str_t errstr;
 
+    buf[bufsize-1] = '\0';
+
     if (cmsg.slen == 0) {
         /* Not found */
@@ -144 +146 @@
         errstr.ptr = buf;
         pj_strncpy(&errstr, &cmsg, bufsize);
+        if (errstr.slen < (int)bufsize)
+            buf[errstr.slen] = '\0';
+        else
+            buf[bufsize-1] = '\0';
     }
 

pjproject/trunk/pjnath/src/pjnath/stun_msg.c

@@ -233 +233 @@
     },
     {
-        /* ID 0x000F is not assigned */
-        NULL,
-        NULL,
-        NULL
+        /* PJ_STUN_ATTR_MAGIC_COOKIE */
+        "MAGIC-COOKIE",
+        &decode_uint_attr,
+        &encode_uint_attr
     },
     {
@@ -1773 +1773 @@
     /* Parse attributes */
     uattr_cnt = 0;
-    while (pdu_len > 0) {
+    while (pdu_len >= 4) {
         unsigned attr_type, attr_val_len;
         const struct attr_desc *adesc;
@@ -1780 +1780 @@
          * to 4 bytes boundary, add padding.
          */
-        attr_type = pj_ntohs(*(pj_uint16_t*)pdu);
-        attr_val_len = pj_ntohs(*(pj_uint16_t*)(pdu+2));
+        attr_type = GETVAL16H(pdu, 0);
+        attr_val_len = GETVAL16H(pdu, 2);
         attr_val_len = (attr_val_len + 3) & (~3);
 
@@ -1920 +1920 @@
         }
 
-        pdu += (attr_val_len + 4);
-        pdu_len -= (attr_val_len + 4);
+        if (attr_val_len + 4 >= pdu_len) {
+            pdu += pdu_len;
+            pdu_len = 0;
+        } else {
+            pdu += (attr_val_len + 4);
+            pdu_len -= (attr_val_len + 4);
+        }
+    }
+
+    if (pdu_len > 0) {
+        /* Stray trailing bytes */
+        PJ_LOG(4,(THIS_FILE, 
+                  "Error decoding STUN message: unparsed trailing %d bytes",
+                  pdu_len));
+        return PJNATH_EINSTUNMSGLEN;
     }
 

pjproject/trunk/pjnath/src/pjstun-client/client_main.c

@@ -185 +185 @@
     status = pj_init();
     status = pjlib_util_init();
+    status = pjnath_init();
 
     pj_caching_pool_init(&g.cp, &pj_pool_factory_default_policy, 0);