FS-10394: [freeswitch-core] FS Crash while linphone sends ICE packets

diff --git a/src/switch_stun.c b/src/switch_stun.c
index 1d10d809cfad8e078f1be9de5ba6b3a443376f39..6573d3eceb186a8d140c93e825b8d5f12b766a85 100644 (file)
--- a/src/switch_stun.c
+++ b/src/switch_stun.c
@@ -216,7 +216,7 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui
 
                alen = switch_stun_attribute_padded_length(attr);
                
-               if (alen > (int)bytes_left || alen <= 0) {
+               if (alen > (int)bytes_left || alen < 0) {
                        /*
                         * Note we simply don't "break" here out of the loop anymore because
                         * we don't want the upper layers to have to deal with attributes without a value
@@ -330,6 +330,9 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui
                }
 
                bytes_left -= alen;     /* attribute value consumed, substract padded length */
+
+               if (alen == 0) break;
+
                xlen += 4 + alen;
 
                attr = (switch_stun_packet_attribute_t *) (attr->value + alen);