瀏覽代碼

core: parser sdp - check for length of sendrecv attribute

(cherry picked from commit fc4817064f81ef9a82b1b1468b1b8a4ae352c1f2)
Daniel-Constantin Mierla 11 月之前
父節點
當前提交
0ba1666fec
共有 1 個文件被更改,包括 3 次插入0 次删除
  1. 3 0
      src/core/parser/sdp/sdp_helpr_funcs.c

+ 3 - 0
src/core/parser/sdp/sdp_helpr_funcs.c

@@ -447,6 +447,9 @@ int extract_sendrecv_mode(str *body, str *sendrecv_mode, int *is_on_hold)
 {
 {
 	char *cp1;
 	char *cp1;
 
 
+	if(body->len < 10) {
+		return -1;
+	}
 	cp1 = body->s;
 	cp1 = body->s;
 	if(!((strncasecmp(cp1, "a=sendrecv", 10) == 0)
 	if(!((strncasecmp(cp1, "a=sendrecv", 10) == 0)
 			   || (strncasecmp(cp1, "a=recvonly", 10) == 0))) {
 			   || (strncasecmp(cp1, "a=recvonly", 10) == 0))) {