[Freeswitch-svn] [commit] r6846 - freeswitch/trunk/src

[Freeswitch SVN]

Author: mikej
Date: Mon Dec 17 18:43:15 2007
New Revision: 6846

Modified:
   freeswitch/trunk/src/switch_rtp.c

Log:
bounds check length passed to memcpy.

Modified: freeswitch/trunk/src/switch_rtp.c
==============================================================================
--- freeswitch/trunk/src/switch_rtp.c	(original)
+++ freeswitch/trunk/src/switch_rtp.c	Mon Dec 17 18:43:15 2007
@@ -215,8 +215,13 @@
 	switch_stun_packet_attribute_t *attr;
 	char username[33] = { 0 };
 	unsigned char buf[512] = { 0 };
+	switch_size_t cpylen = len;
+	
+	if (cpylen > 512) {
+		cpylen = 512;
+	}
 
-	memcpy(buf, data, len);
+	memcpy(buf, data, cpylen);
 	packet = switch_stun_packet_parse(buf, sizeof(buf));
 	rtp_session->last_stun = switch_time_now();
 
@@ -1651,6 +1656,10 @@
 		return -1;
 	}
 
+	if (datalen > SWITCH_RTP_MAX_BUF_LEN) {
+		return -1;
+	}
+
 	send_msg = rtp_session->send_msg;
 	send_msg.header.seq = htons(mseq);
 	send_msg.header.ts = htonl(ts);