From: Michael Jerris <mike@jerris.com>
Date: Mon, 17 Dec 2007 23:43:15 +0000 (+0000)
Subject: bounds check length passed to memcpy.
X-Git-Tag: v1.0-rc1~1017
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6683db6581f29c7d2d4074e649239c9e5a5f96b4;p=thirdparty%2Ffreeswitch.git

bounds check length passed to memcpy.

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@6846 d0543943-73ff-0310-b7d9-9358b9ac24b2
---

diff --git a/src/switch_rtp.c b/src/switch_rtp.c
index 521025a446..9447f1bc78 100644
--- a/src/switch_rtp.c
+++ b/src/switch_rtp.c
@@ -215,8 +215,13 @@ static void handle_ice(switch_rtp_t *rtp_session, void *data, switch_size_t len)
 	switch_stun_packet_attribute_t *attr;
 	char username[33] = { 0 };
 	unsigned char buf[512] = { 0 };
+	switch_size_t cpylen = len;
+	
+	if (cpylen > 512) {
+		cpylen = 512;
+	}
 
-	memcpy(buf, data, len);
+	memcpy(buf, data, cpylen);
 	packet = switch_stun_packet_parse(buf, sizeof(buf));
 	rtp_session->last_stun = switch_time_now();
 
@@ -1651,6 +1656,10 @@ SWITCH_DECLARE(int) switch_rtp_write_manual(switch_rtp_t *rtp_session,
 		return -1;
 	}
 
+	if (datalen > SWITCH_RTP_MAX_BUF_LEN) {
+		return -1;
+	}
+
 	send_msg = rtp_session->send_msg;
 	send_msg.header.seq = htons(mseq);
 	send_msg.header.ts = htonl(ts);