Commit e2dd7d8e authored by Youness Alaoui's avatar Youness Alaoui

Fix a possible bug with buffer overflows

parent 43049e78
......@@ -304,13 +304,13 @@ void *
stun_message_append (StunMessage *msg, stun_attr_type_t type, size_t length)
{
uint8_t *a;
uint16_t mlen = stun_message_length (msg) - STUN_MESSAGE_HEADER_LENGTH;
uint16_t mlen = stun_message_length (msg);
if ((((size_t)mlen) + STUN_ATTRIBUTE_HEADER_LENGTH + length) > msg->buffer_len)
if ((size_t)mlen + STUN_ATTRIBUTE_HEADER_LENGTH + length > msg->buffer_len)
return NULL;
a = msg->buffer + STUN_MESSAGE_HEADER_LENGTH + mlen;
a = msg->buffer + mlen;
a = stun_setw (a, type);
/* NOTE: If cookie is not present, we need to force the attribute length
* to a multiple of 4 for compatibility with old RFC3489 */
......@@ -321,7 +321,7 @@ stun_message_append (StunMessage *msg, stun_attr_type_t type, size_t length)
memset (a + length, ' ', stun_padding (length));
mlen += stun_padding (length);
stun_setw (msg->buffer + STUN_MESSAGE_LENGTH_POS, mlen);
stun_setw (msg->buffer + STUN_MESSAGE_LENGTH_POS, mlen - STUN_MESSAGE_HEADER_LENGTH);
return a;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment