Fix segfault in sofia's stun code

diff --git a/libs/sofia-sip/libsofia-sip-ua/stun/stun_common.c b/libs/sofia-sip/libsofia-sip-ua/stun/stun_common.c
index 33b1a424586380dd6a3f73b3e244b3799abcaee7..f67656363d7da981fc172e9e37e35ff5f03a6d89 100644 (file)
--- a/libs/sofia-sip/libsofia-sip-ua/stun/stun_common.c
+++ b/libs/sofia-sip/libsofia-sip-ua/stun/stun_common.c
@@ -100,7 +100,7 @@ int stun_parse_message(stun_msg_t *msg)
   msg->stun_attr = NULL;
   while (len > 0) {
     i = stun_parse_attribute(msg, p);
-    if (i <= 0) {
+    if (i <= 0 || i > len) {
       SU_DEBUG_3(("%s: Error parsing attribute.\n", __func__));
       return -1;
     }