Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
L
libnice
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
cpp-libs
libnice
Commits
e2dd7d8e
Commit
e2dd7d8e
authored
Jun 16, 2008
by
Youness Alaoui
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fix a possible bug with buffer overflows
parent
43049e78
Changes
1
Show whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
5 additions
and
5 deletions
+5
-5
stun/stunmessage.c
stun/stunmessage.c
+5
-5
No files found.
stun/stunmessage.c
View file @
e2dd7d8e
...
@@ -304,13 +304,13 @@ void *
...
@@ -304,13 +304,13 @@ void *
stun_message_append
(
StunMessage
*
msg
,
stun_attr_type_t
type
,
size_t
length
)
stun_message_append
(
StunMessage
*
msg
,
stun_attr_type_t
type
,
size_t
length
)
{
{
uint8_t
*
a
;
uint8_t
*
a
;
uint16_t
mlen
=
stun_message_length
(
msg
)
-
STUN_MESSAGE_HEADER_LENGTH
;
uint16_t
mlen
=
stun_message_length
(
msg
);
if
((
((
size_t
)
mlen
)
+
STUN_ATTRIBUTE_HEADER_LENGTH
+
length
)
>
msg
->
buffer_len
)
if
((
size_t
)
mlen
+
STUN_ATTRIBUTE_HEADER_LENGTH
+
length
>
msg
->
buffer_len
)
return
NULL
;
return
NULL
;
a
=
msg
->
buffer
+
STUN_MESSAGE_HEADER_LENGTH
+
mlen
;
a
=
msg
->
buffer
+
mlen
;
a
=
stun_setw
(
a
,
type
);
a
=
stun_setw
(
a
,
type
);
/* NOTE: If cookie is not present, we need to force the attribute length
/* NOTE: If cookie is not present, we need to force the attribute length
* to a multiple of 4 for compatibility with old RFC3489 */
* to a multiple of 4 for compatibility with old RFC3489 */
...
@@ -321,7 +321,7 @@ stun_message_append (StunMessage *msg, stun_attr_type_t type, size_t length)
...
@@ -321,7 +321,7 @@ stun_message_append (StunMessage *msg, stun_attr_type_t type, size_t length)
memset
(
a
+
length
,
' '
,
stun_padding
(
length
));
memset
(
a
+
length
,
' '
,
stun_padding
(
length
));
mlen
+=
stun_padding
(
length
);
mlen
+=
stun_padding
(
length
);
stun_setw
(
msg
->
buffer
+
STUN_MESSAGE_LENGTH_POS
,
mlen
);
stun_setw
(
msg
->
buffer
+
STUN_MESSAGE_LENGTH_POS
,
mlen
-
STUN_MESSAGE_HEADER_LENGTH
);
return
a
;
return
a
;
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment