Changeset 2995 for pjproject/trunk

Timestamp:

Nov 9, 2009 5:18:12 AM (15 years ago)

Author:

bennylp

Message:

Ticket #988: Aray bounds checking in SDP functions (thanks Mark Webster for the report)

Location:

pjproject/trunk/pjmedia

Files:

• include/pjmedia/sdp.h (modified) (1 diff)
• src/pjmedia/sdp.c (modified) (7 diffs)

pjproject/trunk/pjmedia/include/pjmedia/sdp.h

@@ -653 +653 @@
 
 
+/**
+ * Add new attribute to the session descriptor.
+ *
+ * @param s             The SDP session description.
+ * @param attr          Attribute to add.
+ *
+ * @return              PJ_SUCCESS or the appropriate error code.
+ */
+PJ_DECL(pj_status_t) pjmedia_sdp_session_add_attr(pjmedia_sdp_session *m,
+                                                  pjmedia_sdp_attr *attr);
+
+
 PJ_END_DECL
 

pjproject/trunk/pjmedia/src/pjmedia/sdp.c

@@ -175 +175 @@
 
 
+
 PJ_DEF(pj_status_t) pjmedia_sdp_attr_add(unsigned *count,
                                          pjmedia_sdp_attr *attr_array[],
@@ -679 +680 @@
 {
     return pjmedia_sdp_attr_add(&m->attr_count, m->attr, attr);
+}
+
+PJ_DEF(pj_status_t) pjmedia_sdp_session_add_attr(pjmedia_sdp_session *s,
+                                                 pjmedia_sdp_attr *attr)
+{
+    return pjmedia_sdp_attr_add(&s->attr_count, s->attr, attr);
 }
 
@@ -979 +986 @@
     med->desc.fmt_count = 0;
     while (*scanner->curptr == ' ') {
+        pj_str_t fmt;
+
         pj_scan_get_char(scanner);
 
@@ -985 +994 @@
                 break;
 
-        pj_scan_get(scanner, &cs_token, &med->desc.fmt[med->desc.fmt_count++]);
+        pj_scan_get(scanner, &cs_token, &fmt);
+        if (med->desc.fmt_count < PJMEDIA_MAX_SDP_FMT)
+            med->desc.fmt[med->desc.fmt_count++] = fmt;
+        else
+            PJ_PERROR(2,(THIS_FILE, PJ_ETOOMANY, 
+                         "Error adding SDP media format %.*s, "
+                         "format is ignored",
+                         (int)fmt.slen, fmt.ptr));
     }
 
@@ -1083 +1099 @@
                     if (attr) {
                         if (media) {
-                            media->attr[media->attr_count++] = attr;
+                            pjmedia_sdp_media_add_attr(media, attr);
                         } else {
-                            session->attr[session->attr_count++] = attr;
+                            pjmedia_sdp_session_add_attr(session, attr);
                         }
                     }
@@ -1110 +1126 @@
                     media = PJ_POOL_ZALLOC_T(pool, pjmedia_sdp_media);
                     parse_media(&scanner, media, &ctx);
-                    session->media[ session->media_count++ ] = media;
+                    if (session->media_count < PJMEDIA_MAX_SDP_MEDIA)
+                        session->media[ session->media_count++ ] = media;
+                    else
+                        PJ_PERROR(2,(THIS_FILE, PJ_ETOOMANY,
+                                     "Error adding media, media is ignored"));
                     break;
                 case 'v':
@@ -1353 +1373 @@
     static const pj_str_t ID_INACTIVE = { "inactive", 8 };
 
+    if (m->attr_count >= PJMEDIA_MAX_SDP_ATTR)
+        return PJ_ETOOMANY;
+
     attr = pjmedia_sdp_attr_create(pool, ID_INACTIVE.ptr, NULL);
     if (NULL == attr)
         return PJ_ENOMEM;
 
-    m->attr[m->attr_count++] = attr;
+    pjmedia_sdp_media_add_attr(m, attr);
     m->desc.port = 0;