diff options
| author | Liong Sauw Ming <ming@teluu.com> | 2012-10-12 06:19:32 +0000 |
|---|---|---|
| committer | Liong Sauw Ming <ming@teluu.com> | 2012-10-12 06:19:32 +0000 |
| commit | 41a256200fd0bb16cc81f6d128758bff748739ef (patch) | |
| tree | 2075827bd50c90da0bf6eb0dbd4a12a33fe90c2b /pjmedia/src/pjmedia | |
| parent | 6516f9d1c6caaa11b3d8c6df9b0b8c66c8d29c74 (diff) | |
Re #1559: Fixed potential buffer overflow when duplicating the string
git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@4283 74dad513-b988-da41-8d7b-12977e46ad98
Diffstat (limited to 'pjmedia/src/pjmedia')
| -rw-r--r-- | pjmedia/src/pjmedia/rtcp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/pjmedia/src/pjmedia/rtcp.c b/pjmedia/src/pjmedia/rtcp.c index 52274155..f45b8a60 100644 --- a/pjmedia/src/pjmedia/rtcp.c +++ b/pjmedia/src/pjmedia/rtcp.c @@ -752,7 +752,8 @@ static void parse_rtcp_bye(pjmedia_rtcp_session *sess, /* Check and get BYE reason */ if (size > 8) { - reason.slen = *((pj_uint8_t*)pkt+8); + reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_), + *((pj_uint8_t*)pkt+8)); pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9), reason.slen); reason.ptr = sess->stat.peer_sdes_buf_; |