Author: anthonyl Date: Mon Feb 5 22:27:09 2007 New Revision: 4130 Modified: freeswitch/branches/anthonyl/fs-branch/src/switch_stun.c Log: add a small check to prevent a malformed stun packet from causing problems Modified: freeswitch/branches/anthonyl/fs-branch/src/switch_stun.c ============================================================================== --- freeswitch/branches/anthonyl/fs-branch/src/switch_stun.c (original) +++ freeswitch/branches/anthonyl/fs-branch/src/switch_stun.c Mon Feb 5 22:27:09 2007 @@ -126,9 +126,10 @@ do { attr->length = ntohs(attr->length); attr->type = ntohs(attr->type); - if (!attr->length) { - break; - } + /* this looks very messy */ + if (!attr->length || ((char *)attr+attr->length) > ((char *)buf+len)) { + break; + } switch(attr->type) { case SWITCH_STUN_ATTR_MAPPED_ADDRESS: if (attr->type) {