提交 16365501 authored 作者: Travis Cross's avatar Travis Cross

Add immediate sanity check on untrusted length

We were actually checking this indirectly in the loop that follows,
but it's more clear to check this immediately and directly.
上级 711e49c4
......@@ -129,7 +129,8 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui
packet = (switch_stun_packet_t *) buf;
packet->header.type = ntohs(packet->header.type);
packet->header.length = ntohs(packet->header.length);
bytes_left -= 20;
if (packet->header.length > (bytes_left -= 20))
return NULL;
/*
......
Markdown 格式
0%
您添加了 0 到此讨论。请谨慎行事。
请先完成此评论的编辑!
注册 或者 后发表评论