Author: mikej Date: Thu Jan 17 01:07:17 2008 New Revision: 7262 Modified: freeswitch/trunk/src/switch_rtp.c Log: add bounds checking Modified: freeswitch/trunk/src/switch_rtp.c ============================================================================== --- freeswitch/trunk/src/switch_rtp.c (original) +++ freeswitch/trunk/src/switch_rtp.c Thu Jan 17 01:07:17 2008 @@ -491,20 +491,22 @@ unsigned char *key, switch_size_t keylen) { - switch_rtp_crypto_key_t *crypto_key; srtp_policy_t *policy; err_status_t stat; switch_status_t status = SWITCH_STATUS_SUCCESS; + if (direction >= SWITCH_RTP_CRYPTO_MAX || keylen > SWITCH_RTP_MAX_CRYPTO_LEN) { + return SWITCH_STATUS_FALSE; + } + crypto_key = switch_core_alloc(rtp_session->pool, sizeof(*crypto_key)); - + if (direction == SWITCH_RTP_CRYPTO_RECV) { policy = &rtp_session->recv_policy; } else { policy = &rtp_session->send_policy; } - crypto_key->type = type; crypto_key->index = index; @@ -512,9 +514,7 @@ crypto_key->next = rtp_session->crypto_keys[direction]; rtp_session->crypto_keys[direction] = crypto_key; - memset(policy, 0, sizeof(*policy)); - switch(crypto_key->type) { case AES_CM_128_HMAC_SHA1_80: @@ -527,7 +527,6 @@ break; } - policy->next = NULL; policy->key = (uint8_t *) crypto_key->key; crypto_policy_set_rtcp_default(&policy->rtcp); @@ -581,9 +580,9 @@ } return SWITCH_STATUS_SUCCESS; - } + SWITCH_DECLARE(switch_status_t) switch_rtp_create(switch_rtp_t **new_rtp_session, switch_payload_t payload, uint32_t samples_per_interval,