[sr-dev] git:master:fc481706: core: parser sdp - check for length of sendrecv attribute

Module: kamailio Branch: master Commit: fc4817064f81ef9a82b1b1468b1b8a4ae352c1f2 URL: https://github.com/kamailio/kamailio/commit/fc4817064f81ef9a82b1b1468b1b8a4… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2024-10-11T11:41:02+02:00 core: parser sdp - check for length of sendrecv attribute --- Modified: src/core/parser/sdp/sdp_helpr_funcs.c --- Diff: https://github.com/kamailio/kamailio/commit/fc4817064f81ef9a82b1b1468b1b8a4… Patch: https://github.com/kamailio/kamailio/commit/fc4817064f81ef9a82b1b1468b1b8a4… --- diff --git a/src/core/parser/sdp/sdp_helpr_funcs.c b/src/core/parser/sdp/sdp_helpr_funcs.c index a5dffd9c398..a5186fb4428 100644 --- a/src/core/parser/sdp/sdp_helpr_funcs.c +++ b/src/core/parser/sdp/sdp_helpr_funcs.c @@ -447,6 +447,9 @@ int extract_sendrecv_mode(str *body, str *sendrecv_mode, int *is_on_hold) { char *cp1; + if(body->len < 10) { + return -1; + } cp1 = body->s; if(!((strncasecmp(cp1, "a=sendrecv", 10) == 0) || (strncasecmp(cp1, "a=recvonly", 10) == 0))) {