Commit dd53998e authored by Youness Alaoui's avatar Youness Alaoui

coverity: fix possible buffer overrun with turn and IPv6. Use sockaddr_storage

parent f4a681be
...@@ -659,16 +659,16 @@ priv_binding_expired_timeout (gpointer data) ...@@ -659,16 +659,16 @@ priv_binding_expired_timeout (gpointer data)
priv->channels = g_list_remove (priv->channels, b); priv->channels = g_list_remove (priv->channels, b);
/* Make sure we don't free a currently being-refreshed binding */ /* Make sure we don't free a currently being-refreshed binding */
if (priv->current_binding_msg && !priv->current_binding) { if (priv->current_binding_msg && !priv->current_binding) {
struct sockaddr sa; struct sockaddr_storage sa;
socklen_t sa_len = sizeof(sa); socklen_t sa_len = sizeof(sa);
NiceAddress to; NiceAddress to;
/* look up binding associated with peer */ /* look up binding associated with peer */
stun_message_find_xor_addr ( stun_message_find_xor_addr (
&priv->current_binding_msg->message, &priv->current_binding_msg->message,
STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &sa, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, (struct sockaddr *) &sa,
&sa_len); &sa_len);
nice_address_set_from_sockaddr (&to, &sa); nice_address_set_from_sockaddr (&to, (struct sockaddr *) &sa);
/* If the binding is being refreshed, then move it to /* If the binding is being refreshed, then move it to
priv->current_binding so it counts as a 'new' binding and priv->current_binding so it counts as a 'new' binding and
...@@ -833,16 +833,16 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock, ...@@ -833,16 +833,16 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock,
} else { } else {
/* Existing binding refresh */ /* Existing binding refresh */
GList *i; GList *i;
struct sockaddr sa; struct sockaddr_storage sa;
socklen_t sa_len = sizeof(sa); socklen_t sa_len = sizeof(sa);
NiceAddress to; NiceAddress to;
/* look up binding associated with peer */ /* look up binding associated with peer */
stun_message_find_xor_addr ( stun_message_find_xor_addr (
&priv->current_binding_msg->message, &priv->current_binding_msg->message,
STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &sa, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, (struct sockaddr *) &sa,
&sa_len); &sa_len);
nice_address_set_from_sockaddr (&to, &sa); nice_address_set_from_sockaddr (&to, (struct sockaddr *) &sa);
for (i = priv->channels; i; i = i->next) { for (i = priv->channels; i; i = i->next) {
ChannelBinding *b = i->data; ChannelBinding *b = i->data;
...@@ -928,16 +928,16 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock, ...@@ -928,16 +928,16 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock,
if (memcmp (request_id, response_id, if (memcmp (request_id, response_id,
sizeof(StunTransactionId)) == 0) { sizeof(StunTransactionId)) == 0) {
struct sockaddr peer; struct sockaddr_storage peer;
socklen_t peer_len = sizeof(peer); socklen_t peer_len = sizeof(peer);
NiceAddress to; NiceAddress to;
nice_debug ("got response for CreatePermission"); nice_debug ("got response for CreatePermission");
stun_message_find_xor_addr ( stun_message_find_xor_addr (
&priv->current_create_permission_msg->message, &priv->current_create_permission_msg->message,
STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &peer, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, (struct sockaddr *) &peer,
&peer_len); &peer_len);
nice_address_set_from_sockaddr (&to, &peer); nice_address_set_from_sockaddr (&to, (struct sockaddr *) &peer);
/* unathorized => resend with realm and nonce */ /* unathorized => resend with realm and nonce */
if (stun_message_get_class (&msg) == STUN_ERROR) { if (stun_message_get_class (&msg) == STUN_ERROR) {
...@@ -1021,7 +1021,7 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock, ...@@ -1021,7 +1021,7 @@ nice_turn_socket_parse_recv (NiceSocket *sock, NiceSocket **from_sock,
if (data == NULL) if (data == NULL)
goto recv; goto recv;
nice_address_set_from_sockaddr (from, (struct sockaddr *)&sa); nice_address_set_from_sockaddr (from, (struct sockaddr *) &sa);
*from_sock = sock; *from_sock = sock;
memmove (buf, data, len > data_len ? data_len : len); memmove (buf, data, len > data_len ? data_len : len);
...@@ -1167,16 +1167,16 @@ priv_retransmissions_create_permission_tick_unlocked (TurnPriv *priv) ...@@ -1167,16 +1167,16 @@ priv_retransmissions_create_permission_tick_unlocked (TurnPriv *priv)
/* Time out */ /* Time out */
StunTransactionId id; StunTransactionId id;
NiceAddress to; NiceAddress to;
struct sockaddr addr; struct sockaddr_storage addr;
socklen_t addr_len = sizeof(addr); socklen_t addr_len = sizeof(addr);
stun_message_id (&priv->current_create_permission_msg->message, id); stun_message_id (&priv->current_create_permission_msg->message, id);
stun_agent_forget_transaction (&priv->agent, id); stun_agent_forget_transaction (&priv->agent, id);
stun_message_find_xor_addr ( stun_message_find_xor_addr (
&priv->current_create_permission_msg->message, &priv->current_create_permission_msg->message,
STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &addr, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, (struct sockaddr *) &addr,
&addr_len); &addr_len);
nice_address_set_from_sockaddr (&to, &addr); nice_address_set_from_sockaddr (&to, (struct sockaddr *) &addr);
priv_remove_sent_permission_for_peer (priv, &to); priv_remove_sent_permission_for_peer (priv, &to);
g_free (priv->current_create_permission_msg); g_free (priv->current_create_permission_msg);
...@@ -1328,7 +1328,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp, ...@@ -1328,7 +1328,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp,
guint msg_buf_len; guint msg_buf_len;
gboolean res = FALSE; gboolean res = FALSE;
TURNMessage *msg = g_new0 (TURNMessage, 1); TURNMessage *msg = g_new0 (TURNMessage, 1);
struct sockaddr addr; struct sockaddr_storage addr;
uint8_t *realm = NULL; uint8_t *realm = NULL;
uint16_t realm_len = 0; uint16_t realm_len = 0;
uint8_t *nonce = NULL; uint8_t *nonce = NULL;
...@@ -1346,7 +1346,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp, ...@@ -1346,7 +1346,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp,
priv_add_sent_permission_for_peer (priv, peer); priv_add_sent_permission_for_peer (priv, peer);
} }
nice_address_copy_to_sockaddr (peer, &addr); nice_address_copy_to_sockaddr (peer, (struct sockaddr *) &addr);
/* send CreatePermission */ /* send CreatePermission */
msg_buf_len = stun_usage_turn_create_permission(&priv->agent, &msg->message, msg_buf_len = stun_usage_turn_create_permission(&priv->agent, &msg->message,
...@@ -1358,7 +1358,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp, ...@@ -1358,7 +1358,7 @@ priv_send_create_permission(TurnPriv *priv, StunMessage *resp,
priv->password_len, priv->password_len,
realm, realm_len, realm, realm_len,
nonce, nonce_len, nonce, nonce_len,
&addr, (struct sockaddr *) &addr,
NICE_TURN_SOCKET_COMPATIBILITY_RFC5766); NICE_TURN_SOCKET_COMPATIBILITY_RFC5766);
if (msg_buf_len > 0) { if (msg_buf_len > 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment