Author: mikej Date: Mon Dec 17 18:43:15 2007 New Revision: 6846 Modified: freeswitch/trunk/src/switch_rtp.c Log: bounds check length passed to memcpy. Modified: freeswitch/trunk/src/switch_rtp.c ============================================================================== --- freeswitch/trunk/src/switch_rtp.c (original) +++ freeswitch/trunk/src/switch_rtp.c Mon Dec 17 18:43:15 2007 @@ -215,8 +215,13 @@ switch_stun_packet_attribute_t *attr; char username[33] = { 0 }; unsigned char buf[512] = { 0 }; + switch_size_t cpylen = len; + + if (cpylen > 512) { + cpylen = 512; + } - memcpy(buf, data, len); + memcpy(buf, data, cpylen); packet = switch_stun_packet_parse(buf, sizeof(buf)); rtp_session->last_stun = switch_time_now(); @@ -1651,6 +1656,10 @@ return -1; } + if (datalen > SWITCH_RTP_MAX_BUF_LEN) { + return -1; + } + send_msg = rtp_session->send_msg; send_msg.header.seq = htons(mseq); send_msg.header.ts = htonl(ts);