Module: kamailio Branch: 5.5 Commit: d7c030f576fa87b5959b7156c6b2077d76bb1fee URL: https://github.com/kamailio/kamailio/commit/d7c030f576fa87b5959b7156c6b2077… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2021-12-16T08:29:59+01:00 core: parser/sdp - check for delimiter size done before comparison (cherry picked from commit b83810eb1eb70f326698db874a1f67cf6a8d06cf) --- Modified: src/core/parser/sdp/sdp_helpr_funcs.c --- Diff: https://github.com/kamailio/kamailio/commit/d7c030f576fa87b5959b7156c6b2077… Patch: https://github.com/kamailio/kamailio/commit/d7c030f576fa87b5959b7156c6b2077… --- diff --git a/src/core/parser/sdp/sdp_helpr_funcs.c b/src/core/parser/sdp/sdp_helpr_funcs.c index 144d63b537..c62a347ddc 100644 --- a/src/core/parser/sdp/sdp_helpr_funcs.c +++ b/src/core/parser/sdp/sdp_helpr_funcs.c @@ -794,12 +794,12 @@ char *find_sdp_line_delimiter(char* p, char* plimit, str delimiter) return NULL; /* We matched '--', * now let's match the boundary delimiter */ + if(cp1+2+delimiter.len >= plimit) + return NULL; if (strncmp(cp1+2, delimiter.s, delimiter.len) == 0) break; else cp = cp1 + 2 + delimiter.len; - if (cp >= plimit) - return NULL; } if (cp1[-1] == '\n' || cp1[-1] == '\r') return cp1;