Commit 64d3f188 authored by Philip Withnall's avatar Philip Withnall Committed by Olivier Crête

agent: Avoid memcpy()ing garbage between username strings

If (username_len > uname_len), memcpy() would fall off the end of the
uname string and copy (username_len - uname_len) bytes of garbage into
username.

Theoretical bug: not actually attempted to be demonstrated in the wild.
parent 270c6166
...@@ -2929,7 +2929,7 @@ gboolean conn_check_handle_inbound_stun (NiceAgent *agent, Stream *stream, ...@@ -2929,7 +2929,7 @@ gboolean conn_check_handle_inbound_stun (NiceAgent *agent, Stream *stream,
uname_len = priv_create_username (agent, stream, uname_len = priv_create_username (agent, stream,
component->id, remote_candidate2, local_candidate, component->id, remote_candidate2, local_candidate,
uname, sizeof (uname), FALSE); uname, sizeof (uname), FALSE);
memcpy (username, uname, username_len); memcpy (username, uname, MIN (uname_len, username_len));
req.key = g_base64_decode ((gchar *) remote_candidate2->password, req.key = g_base64_decode ((gchar *) remote_candidate2->password,
&req.key_len); &req.key_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment