diff options
| author | Kevin Harwell <kharwell@digium.com> | 2018-01-31 13:33:16 -0600 |
|---|---|---|
| committer | Kevin Harwell <kharwell@digium.com> | 2018-02-21 09:26:05 -0600 |
| commit | d3a398cf9058219445fb1c54bfa88bb0f54a2fc4 (patch) | |
| tree | 73b80534659bc051d7f69ec79b69c303e95c5a06 /third-party | |
| parent | a1e6320c4a1c08d17c920b5c39ef0bb055042a4a (diff) | |
AST-2018-002: Crash with an invalid SDP media format description
pjproject's media format parsing algorithm failed to catch invalid values.
Because of this Asterisk would crash if given an SDP with a invalid media
format description.
When parsing the media format description this patch now properly parses the
value and returns an error status if it can't successfully parse/convert the
value.
ASTERISK-27582 #close
Change-Id: I883b3a4ef85b6972397f7b56bf46c5779c55fdd6
Diffstat (limited to 'third-party')
| -rw-r--r-- | third-party/pjproject/patches/0070-sdp_media_fmt.patch | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/third-party/pjproject/patches/0070-sdp_media_fmt.patch b/third-party/pjproject/patches/0070-sdp_media_fmt.patch new file mode 100644 index 000000000..0a0977d55 --- /dev/null +++ b/third-party/pjproject/patches/0070-sdp_media_fmt.patch @@ -0,0 +1,19 @@ +diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c +index a3dd80b..0a13206 100644 +--- a/pjmedia/src/pjmedia/sdp.c ++++ b/pjmedia/src/pjmedia/sdp.c +@@ -1516,11 +1516,12 @@ PJ_DEF(pj_status_t) pjmedia_sdp_validate2(const pjmedia_sdp_session *sdp, + * RTC based programs sends "null" for instant messaging! + */ + if (pj_isdigit(*m->desc.fmt[j].ptr)) { +- unsigned pt = pj_strtoul(&m->desc.fmt[j]); ++ unsigned long pt; ++ pj_status_t status = pj_strtoul3(&m->desc.fmt[j], &pt, 10); + + /* Payload type is between 0 and 127. + */ +- CHECK( pt <= 127, PJMEDIA_SDP_EINPT); ++ CHECK( status == PJ_SUCCESS && pt <= 127, PJMEDIA_SDP_EINPT); + + /* If port is not zero, then for each dynamic payload type, an + * rtpmap attribute must be specified. |