ice: Increase foundation buffer size

Per RFC 5245, the foundation specified with an ICE candidate can be up
to 32 characters but we are only allowing for 31.

ASTERISK-27498 #close
Reported by: Michele Prà

Change-Id: I05ce7a5952721a76a2b4c90366168022558dc7cf

2 files changed, 4 insertions, 4 deletions

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 3ff84153d..ee2eee009 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -11288,7 +11288,7 @@ static int process_sdp_a_ice(const char *a, struct sip_pvt *p, struct ast_rtp_in
 {
 	struct ast_rtp_engine_ice *ice;
 	int found = FALSE;
-	char ufrag[256], pwd[256], foundation[32], transport[4], address[46], cand_type[6], relay_address[46] = "";
+	char ufrag[256], pwd[256], foundation[33], transport[4], address[46], cand_type[6], relay_address[46] = "";
 	struct ast_rtp_engine_ice_candidate candidate = { 0, };
 	unsigned int port, relay_port = 0;
 
@@ -11302,7 +11302,7 @@ static int process_sdp_a_ice(const char *a, struct sip_pvt *p, struct ast_rtp_in
 	} else if (sscanf(a, "ice-pwd: %255s", pwd) == 1) {
 		ice->set_authentication(instance, NULL, pwd);
 		found = TRUE;
-	} else if (sscanf(a, "candidate: %31s %30u %3s %30u %23s %30u typ %5s %*s %23s %*s %30u", foundation, &candidate.id, transport, (unsigned *)&candidate.priority,
+	} else if (sscanf(a, "candidate: %32s %30u %3s %30u %23s %30u typ %5s %*s %23s %*s %30u", foundation, &candidate.id, transport, (unsigned *)&candidate.priority,
 			  address, &port, cand_type, relay_address, &relay_port) >= 7) {
 
 		if (rtcp_mux_offered && ast_test_flag(&p->flags[2], SIP_PAGE3_RTCP_MUX) && candidate.id > 1) {
diff --git a/res/res_pjsip_sdp_rtp.c b/res/res_pjsip_sdp_rtp.c
index 0fcd509fb..585202787 100644
--- a/res/res_pjsip_sdp_rtp.c
+++ b/res/res_pjsip_sdp_rtp.c
@@ -618,7 +618,7 @@ static void process_ice_attributes(struct ast_sip_session *session, struct ast_s
 
 	/* Find all of the candidates */
 	for (attr_i = 0; attr_i < remote_stream->attr_count; ++attr_i) {
-		char foundation[32], transport[32], address[PJ_INET6_ADDRSTRLEN + 1], cand_type[6], relay_address[PJ_INET6_ADDRSTRLEN + 1] = "";
+		char foundation[33], transport[32], address[PJ_INET6_ADDRSTRLEN + 1], cand_type[6], relay_address[PJ_INET6_ADDRSTRLEN + 1] = "";
 		unsigned int port, relay_port = 0;
 		struct ast_rtp_engine_ice_candidate candidate = { 0, };
 
@@ -631,7 +631,7 @@ static void process_ice_attributes(struct ast_sip_session *session, struct ast_s
 
 		ast_copy_pj_str(attr_value, (pj_str_t*)&attr->value, sizeof(attr_value));
 
-		if (sscanf(attr_value, "%31s %30u %31s %30u %46s %30u typ %5s %*s %23s %*s %30u", foundation, &candidate.id, transport,
+		if (sscanf(attr_value, "%32s %30u %31s %30u %46s %30u typ %5s %*s %23s %*s %30u", foundation, &candidate.id, transport,
 			(unsigned *)&candidate.priority, address, &port, cand_type, relay_address, &relay_port) < 7) {
 			/* Candidate did not parse properly */
 			continue;