Module: kamailio Branch: master Commit: 79d7fae0f26f577356f017cfff5e00c348cf259c URL: https://github.com/kamailio/kamailio/commit/79d7fae0f26f577356f017cfff5e00c… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2024-10-29T08:20:44+01:00 core: parser sdp - check body end for extract_ice_option() --- Modified: src/core/parser/sdp/sdp_helpr_funcs.c --- Diff: https://github.com/kamailio/kamailio/commit/79d7fae0f26f577356f017cfff5e00c… Patch: https://github.com/kamailio/kamailio/commit/79d7fae0f26f577356f017cfff5e00c… --- diff --git a/src/core/parser/sdp/sdp_helpr_funcs.c b/src/core/parser/sdp/sdp_helpr_funcs.c index 0e61fe5ca5d..5c7076823c4 100644 --- a/src/core/parser/sdp/sdp_helpr_funcs.c +++ b/src/core/parser/sdp/sdp_helpr_funcs.c @@ -379,22 +379,24 @@ int extract_ice_option(str *body, sdp_stream_cell_t *stream) sdp_ice_opt_t *ice_opt; char *ptr_src; + char *end; int max_options = 10; /* protection - max options can be listed in one line */ int length = 0; /* each option length */ /* a=ice-options: */ - if((body->len < 14) || (strncasecmp(body->s, ICE_OPTIONS, 14) != 0)) + if((body->len <= 14) || (strncasecmp(body->s, ICE_OPTIONS, 14) != 0)) return -1; + end = body->s + body->len; ptr_src = body->s + 14; if(*ptr_src == 32) ptr_src++; /* if starts with a space, skip it */ /* identify all existing ICE options, if they are listed in one row */ - while(*ptr_src && *ptr_src != '\r' && *ptr_src != '\n' + while(ptr_src < end && *ptr_src && *ptr_src != '\r' && *ptr_src != '\n' && max_options-- > 0) { - while(*ptr_src != 32 && *ptr_src && *ptr_src != '\r' + while(ptr_src < end && *ptr_src && *ptr_src != 32 && *ptr_src != '\r' && *ptr_src != '\n') { length++; ptr_src++;