Changeset 3498

Timestamp:

Apr 6, 2011 7:01:55 AM (13 years ago)

Author:

bennylp

Message:

Re #1186: fixed crash when parsing fmtp with more than 8 parameters by enlarging the default limit, fix the crash, and make the limit configurable

Location:

pjproject/branches/projects/2.0-dev/pjmedia

Files:

• include/pjmedia/codec.h (modified) (1 diff)
• include/pjmedia/config.h (modified) (1 diff)
• src/pjmedia/stream_common.c (modified) (2 diffs)

pjproject/branches/projects/2.0-dev/pjmedia/include/pjmedia/codec.h

@@ -241 +241 @@
 } pjmedia_codec_info;
 
-#define PJMEDIA_CODEC_MAX_FMTP_CNT  8
-
 /** 
  * Structure of codec specific parameters which contains name=value pairs.

pjproject/branches/projects/2.0-dev/pjmedia/include/pjmedia/config.h

@@ -569 +569 @@
 
 /**
+ * Maximum number of parameters in SDP fmtp attribute.
+ *
+ * Default: 16
+ */
+#ifndef PJMEDIA_CODEC_MAX_FMTP_CNT
+#   define PJMEDIA_CODEC_MAX_FMTP_CNT           16
+#endif
+
+
+/**
  * This specifies the behavior of the SDP negotiator when responding to an
  * offer, whether it should rather use the codec preference as set by

pjproject/branches/projects/2.0-dev/pjmedia/src/pjmedia/stream_common.c

@@ -18 +18 @@
  */
 #include <pjmedia/stream_common.h>
+#include <pj/log.h>
+
+#define THIS_FILE       "stream_common.c"
 
 /*
@@ -56 +59 @@
     while (p < p_end) {
         char *token, *start, *end;
+
+        if (fmtp->cnt >= PJMEDIA_CODEC_MAX_FMTP_CNT) {
+            PJ_LOG(4,(THIS_FILE,
+                      "Warning: fmtp parameter count exceeds "
+                      "PJMEDIA_CODEC_MAX_FMTP_CNT"));
+            return PJ_SUCCESS;
+        }
 
         /* Skip whitespaces */