generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Resolves CID 10540: Copy into fixed size buffer (STRING_OVERFLOW).

Browse Source 
You might overrun the 32 byte fixed-size string "receiveCodec.plname" by copying "payloadName" without checking the length.
Note: This defect has an elevated risk because the source argument is a parameter of the current function.
Review URL: http://webrtc-codereview.appspot.com/352009

git-svn-id: http://webrtc.googlecode.com/svn/trunk@1428 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
henrika@webrtc.org 2012-01-16 08:45:42 +00:00
parent f5c6573725
commit f75901fa4c
3 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/common_types.h
View File

@ -25,6 +25,8 @@
#define NULL 0
#endif
#define RTP_PAYLOAD_NAME_SIZE 32
namespace webrtc {
class InStream
@ -203,7 +205,7 @@ protected:
struct CodecInst
{
int pltype;
char plname[32];
char plname[RTP_PAYLOAD_NAME_SIZE];
int plfreq;
int pacsize;
int channels;

1
src/modules/rtp_rtcp/interface/rtp_rtcp_defines.h
View File

@ -20,7 +20,6 @@
#define RTCP_CNAME_SIZE 256 // RFC 3550 page 44, including null termination
#define IP_PACKET_SIZE 1500 // we assume ethernet
#define RTP_PAYLOAD_NAME_SIZE 32
#define MAX_NUMBER_OF_PARALLEL_TELEPHONE_EVENTS 10
#define TIMEOUT_SEI_MESSAGES_MS 30000 // in milliseconds

8
src/voice_engine/main/source/channel.cc
View File

@ -645,15 +645,15 @@ Channel::OnInitializeDecoder(
assert(VoEChannelId(id) == _channelId);
CodecInst receiveCodec;
CodecInst dummyCodec;
CodecInst receiveCodec = {0};
CodecInst dummyCodec = {0};
receiveCodec.pltype = payloadType;
strcpy(receiveCodec.plname, payloadName);
receiveCodec.plfreq = frequency;
receiveCodec.channels = channels;
receiveCodec.rate = rate;
strncpy(receiveCodec.plname, payloadName, RTP_PAYLOAD_NAME_SIZE - 1);
_audioCodingModule.Codec(payloadName, dummyCodec, frequency);
receiveCodec.pacsize = dummyCodec.pacsize;