From: Anthony Minessale <anthm@freeswitch.org>
Date: Wed, 28 Jun 2017 16:32:24 +0000 (-0500)
Subject: FS-10394: [freeswitch-core] FS Crash while linphone sends ICE packets
X-Git-Tag: v1.8.0~420
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=905703c9070387bf20d9b5c81f7611cf85b8ca68;p=thirdparty%2Ffreeswitch.git

FS-10394: [freeswitch-core] FS Crash while linphone sends ICE packets
---

diff --git a/src/switch_stun.c b/src/switch_stun.c
index 1d10d809cf..6573d3eceb 100644
--- a/src/switch_stun.c
+++ b/src/switch_stun.c
@@ -216,7 +216,7 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui
 
 		alen = switch_stun_attribute_padded_length(attr);
 		
-		if (alen > (int)bytes_left || alen <= 0) {
+		if (alen > (int)bytes_left || alen < 0) {
 			/*
 			 * Note we simply don't "break" here out of the loop anymore because
 			 * we don't want the upper layers to have to deal with attributes without a value
@@ -330,6 +330,9 @@ SWITCH_DECLARE(switch_stun_packet_t *) switch_stun_packet_parse(uint8_t *buf, ui
 		}
 
 		bytes_left -= alen;	/* attribute value consumed, substract padded length */
+
+		if (alen == 0) break;
+
 		xlen += 4 + alen;
 
 		attr = (switch_stun_packet_attribute_t *) (attr->value + alen);