Changeset 4283

Timestamp:

Oct 12, 2012 6:19:32 AM (12 years ago)

Author:

ming

Message:

Re #1559: Fixed potential buffer overflow when duplicating the string

Location:

pjproject/trunk/pjmedia/src

Files:

• pjmedia-audiodev/alsa_dev.c (modified) (1 diff)
• pjmedia/rtcp.c (modified) (1 diff)

pjproject/trunk/pjmedia/src/pjmedia-audiodev/alsa_dev.c

@@ -233 +233 @@
 
     /* Set device name */
-    strcpy(adi->name, dev_name);
+    strncpy(adi->name, dev_name, sizeof(adi->name));
 
     /* Check the number of playback channels */

pjproject/trunk/pjmedia/src/pjmedia/rtcp.c

@@ -753 +753 @@
     /* Check and get BYE reason */
     if (size > 8) {
-        reason.slen = *((pj_uint8_t*)pkt+8);
+        reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_),
+                             *((pj_uint8_t*)pkt+8));
         pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9),
                   reason.slen);