diff options
| author | Richard Mudgett <rmudgett@digium.com> | 2015-03-20 18:27:22 +0000 |
|---|---|---|
| committer | Richard Mudgett <rmudgett@digium.com> | 2015-03-20 18:27:22 +0000 |
| commit | 148e8799fefb48fd324ce9b8813d1919ba72a8fd (patch) | |
| tree | ecc529edefd38e53f2468cb2fef8fba09f547e1e /res/res_pjsip_sdp_rtp.c | |
| parent | 627cc16a8d4c3fa40144b8f4ec1fe511cbf783a3 (diff) | |
res_pjsip_sdp_rtp,sorcery: Fix invalid access and memory leak respectively.
Valgrind found a memory leak and invalid access.
* Fix invalid access by sscanf() being fed a non-nul terminated string of
digits in res/res_pjsip_sdp_rtp.c:get_codecs().
* Fix memory leak in main/sorcery.c:sorcery_object_field_destructor().
* Fix potential NULL pointer dereference in
main/xmldoc.c:xmldoc_get_syntax_config_option().
Review: https://reviewboard.asterisk.org/r/4513/
........
Merged revisions 433199 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@433200 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'res/res_pjsip_sdp_rtp.c')
| -rw-r--r-- | res/res_pjsip_sdp_rtp.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/res/res_pjsip_sdp_rtp.c b/res/res_pjsip_sdp_rtp.c index 6856b73f7..f396bfea0 100644 --- a/res/res_pjsip_sdp_rtp.c +++ b/res/res_pjsip_sdp_rtp.c @@ -180,7 +180,11 @@ static void get_codecs(struct ast_sip_session *session, const struct pjmedia_sdp } if ((pjmedia_sdp_attr_get_fmtp(attr, &fmtp)) == PJ_SUCCESS) { - sscanf(pj_strbuf(&fmtp.fmt), "%d", &num); + ast_copy_pj_str(fmt_param, &fmtp.fmt, sizeof(fmt_param)); + if (sscanf(fmt_param, "%30d", &num) != 1) { + continue; + } + if ((format = ast_rtp_codecs_get_payload_format(codecs, num))) { struct ast_format *format_parsed; |