diff options
| author | Joshua Colp <jcolp@digium.com> | 2014-12-10 13:34:05 +0000 |
|---|---|---|
| committer | Joshua Colp <jcolp@digium.com> | 2014-12-10 13:34:05 +0000 |
| commit | fb768ec33a27cc9de76ee7e95ef9f08e0948b47b (patch) | |
| tree | 04c5d4cfd466d1d2333da2ee62a65a6a4f20da0c /res/res_pjsip_transport_websocket.c | |
| parent | a220a08777a3d00595cdc65edafee6a837983aca (diff) | |
res_http_websocket: Fix crash due to double freeing memory when receiving a payload length of zero.
Frames with a payload length of 0 were incorrectly handled in res_http_websocket.
Provided a frame with a payload had been received prior it was possible for a double
free to occur. The realloc operation would succeed (thus freeing the payload) but be
treated as an error. When the session was then torn down the payload would be
freed again causing a crash. The read function now takes this into account.
This change also fixes assumptions made by users of res_http_websocket. There is no
guarantee that a frame received from it will be NULL terminated.
ASTERISK-24472 #close
Reported by: Badalian Vyacheslav
Review: https://reviewboard.asterisk.org/r/4220/
Review: https://reviewboard.asterisk.org/r/4219/
........
Merged revisions 429270 from http://svn.asterisk.org/svn/asterisk/branches/11
........
Merged revisions 429272 from http://svn.asterisk.org/svn/asterisk/branches/12
git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@429273 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'res/res_pjsip_transport_websocket.c')
| -rw-r--r-- | res/res_pjsip_transport_websocket.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/res/res_pjsip_transport_websocket.c b/res/res_pjsip_transport_websocket.c index 1db36bb5a..5616715e0 100644 --- a/res/res_pjsip_transport_websocket.c +++ b/res/res_pjsip_transport_websocket.c @@ -200,7 +200,8 @@ static int transport_read(void *data) pj_gettimeofday(&rdata->pkt_info.timestamp); - pj_memcpy(rdata->pkt_info.packet, read_data->payload, sizeof(rdata->pkt_info.packet)); + pj_memcpy(rdata->pkt_info.packet, read_data->payload, + PJSIP_MAX_PKT_LEN < read_data->payload_len ? PJSIP_MAX_PKT_LEN : read_data->payload_len); rdata->pkt_info.len = read_data->payload_len; rdata->pkt_info.zero = 0; |