Commit 6b1eec06 authored by Jakub Adam's avatar Jakub Adam Committed by Olivier Crête

udp-turn: Avoid potential integer overflow

parent 603ab1d4
...@@ -362,7 +362,7 @@ socket_recv_messages (NiceSocket *sock, ...@@ -362,7 +362,7 @@ socket_recv_messages (NiceSocket *sock,
guint f_buffer_len = priv->fragment_buffer->len; guint f_buffer_len = priv->fragment_buffer->len;
for (i = 0; i < n_recv_messages && f_buffer_len >= sizeof (guint16); ++i) { for (i = 0; i < n_recv_messages && f_buffer_len >= sizeof (guint16); ++i) {
guint16 msg_len = ((f_buffer[0] << 8) | f_buffer[1]) + sizeof (guint16); guint32 msg_len = ((f_buffer[0] << 8) | f_buffer[1]) + sizeof (guint16);
if (msg_len > f_buffer_len) { if (msg_len > f_buffer_len) {
/* The next message in the buffer isn't complete yet. Wait for more /* The next message in the buffer isn't complete yet. Wait for more
...@@ -450,7 +450,7 @@ socket_recv_messages (NiceSocket *sock, ...@@ -450,7 +450,7 @@ socket_recv_messages (NiceSocket *sock,
if (nice_socket_is_reliable (sock) && parsed_buffer_length > 0) { if (nice_socket_is_reliable (sock) && parsed_buffer_length > 0) {
/* Determine the portion of the current NiceInputMessage we can already /* Determine the portion of the current NiceInputMessage we can already
* return. */ * return. */
guint16 msg_len = 0; gint32 msg_len = 0;
if (!priv->fragment_buffer) { if (!priv->fragment_buffer) {
msg_len = ((buffer[0] << 8) | buffer[1]) + sizeof (guint16); msg_len = ((buffer[0] << 8) | buffer[1]) + sizeof (guint16);
if (msg_len > parsed_buffer_length) { if (msg_len > parsed_buffer_length) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment