Changeset 3191 for pjproject/trunk

Timestamp:

Jun 2, 2010 9:32:42 AM (14 years ago)

Author:

nanang

Message:

Fix #1074: Fixed SRTP crypto parser to preverify the key length.

File:

• pjproject/trunk/pjmedia/src/pjmedia/transport_srtp.c (modified) (1 diff)

pjproject/trunk/pjmedia/src/pjmedia/transport_srtp.c

@@ -1055 +1055 @@
     }
     tmp = pj_str(token);
+    if (PJ_BASE64_TO_BASE256_LEN(tmp.slen) > MAX_KEY_LEN) {
+        PJ_LOG(4,(THIS_FILE, "Key too long"));
+        return PJMEDIA_SRTP_EINKEYLEN;
+    }
+
+    /* Decode key */
     crypto->key.ptr = (char*) pj_pool_zalloc(pool, MAX_KEY_LEN);
-
-    /* Decode key */
     itmp = MAX_KEY_LEN;
     status = pj_base64_decode(&tmp, (pj_uint8_t*)crypto->key.ptr,