FS-7184: add buffer overflow check in udptl_rx_packet

diff --git a/src/mod/applications/mod_spandsp/udptl.c b/src/mod/applications/mod_spandsp/udptl.c
index d1e21d648dc7187d0cd13c95022796e429537eda..874c30b6867af1f14b4679c91ef56a2a1f99a591 100644 (file)
--- a/src/mod/applications/mod_spandsp/udptl.c
+++ b/src/mod/applications/mod_spandsp/udptl.c
@@ -223,6 +223,9 @@ int udptl_rx_packet(udptl_state_t *s, const uint8_t buf[], int len)
                        if ((stat = decode_length(buf, len, &ptr, &count)) < 0)
                                return -1;
                        for (i = 0; i < count; i++) {
+                               if (total_count + i >= 16) {
+                                       return -1;
+                               }
                                if (decode_open_type(buf, len, &ptr, &bufs[total_count + i], &lengths[total_count + i]) != 0)
                                        return -1;
                        }