Module: kamailio Branch: master Commit: 7076904d0f0980d6bfa0814e3b1a8c61ee0acecc URL: https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61...

Author: Daniel-Constantin Mierla miconda@gmail.com Committer: Daniel-Constantin Mierla miconda@gmail.com Date: 2022-03-11T21:36:16+01:00

core: parse sdp - detect multipart invalid format

---

Modified: src/core/parser/sdp/sdp.c

---

Diff: https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61... Patch: https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61...

---

diff --git a/src/core/parser/sdp/sdp.c b/src/core/parser/sdp/sdp.c index dc584e1c8b..d81413a0a5 100644 --- a/src/core/parser/sdp/sdp.c +++ b/src/core/parser/sdp/sdp.c @@ -685,6 +685,11 @@ static int parse_mixed_content(str *mixed_body, str delimiter, sdp_info_t* _sdp) return -1; } d2p = find_next_sdp_line_delimiter(d1p, bodylimit, delimiter, bodylimit); + if((d1p + delimiter.len + 2 > bodylimit) + || (d2p - d1p < delimiter.len + 2)) { + LM_ERR("invalid format [%.*s]\n", (int)(d2p-d1p), d1p); + return -1; + } /* d2p is text limit for application parsing */ memset(&hf, 0, sizeof(struct hdr_field)); rest = eat_line(d1p + delimiter.len + 2, d2p - d1p - delimiter.len - 2);