Changeset 5106 for pjproject/trunk/pjmedia/src/pjmedia/sdp.c

Timestamp:

Jun 12, 2015 3:03:48 AM (9 years ago)

Author:

riza

Message:

Misc (re #1843): Add index checking to some SDP attr operations. These operations use count parameter as index doesn't check the value which might lead to crash if the count param exceed PJMEDIA_MAX_SDP_ATTR.

File:

• pjproject/trunk/pjmedia/src/pjmedia/sdp.c (modified) (3 diffs)

pjproject/trunk/pjmedia/src/pjmedia/sdp.c

@@ -145 +145 @@
     unsigned c_pt = 0xFFFF;
 
+    PJ_ASSERT_RETURN(count < PJMEDIA_MAX_SDP_ATTR, NULL);
+
     if (c_fmt)
         c_pt = pj_strtoul(c_fmt);
@@ -200 +202 @@
 
     PJ_ASSERT_RETURN(count && attr_array && name, PJ_EINVAL);
+    PJ_ASSERT_RETURN(*count < PJMEDIA_MAX_SDP_ATTR, PJ_ETOOMANY);
 
     attr_name.ptr = (char*)name;
@@ -226 +229 @@
 
     PJ_ASSERT_RETURN(count && attr_array && attr, PJ_EINVAL);
+    PJ_ASSERT_RETURN(*count < PJMEDIA_MAX_SDP_ATTR, PJ_ETOOMANY);
 
     for (i=0; i<*count; ) {