diff options
| author | Michele Campus <fci1908@gmail.com> | 2016-04-12 23:41:02 +0200 |
|---|---|---|
| committer | Michele Campus <fci1908@gmail.com> | 2016-04-12 23:41:02 +0200 |
| commit | da811fbdd0023a0a3dc3f810029ef92e83e1f781 (patch) | |
| tree | 5e75a520f4c2f12ab85b22914f15c8f0857f132e /src/lib/protocols/rtcp.c | |
| parent | 885cc3864eccaa0eaadff7233f5a6a94c4239e24 (diff) | |
| parent | d7a2515093ce64d29020c0768956c6ead1ae23da (diff) | |
Merge pull request #173 from theirix/buffer-overflows
Fixed multiple buffer overflows
Diffstat (limited to 'src/lib/protocols/rtcp.c')
| -rw-r--r-- | src/lib/protocols/rtcp.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/lib/protocols/rtcp.c b/src/lib/protocols/rtcp.c index c8fc90953..be4aee669 100644 --- a/src/lib/protocols/rtcp.c +++ b/src/lib/protocols/rtcp.c @@ -38,7 +38,7 @@ void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct n /* Let's check first the RTCP packet length */ u_int16_t len, offset = 0, rtcp_section_len; - while(offset < packet->payload_packet_len) { + while(offset + 3 < packet->payload_packet_len) { len = packet->payload[2+offset] * 256 + packet->payload[2+offset+1]; rtcp_section_len = (len + 1) * 4; @@ -50,9 +50,10 @@ void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct n sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over udp.\n"); - if(((packet->payload_packet_len >= 28 || packet->payload_packet_len <= 1200) && + /* TODO changed a pair of length condition to the && from ||. Is it correct? */ + if(((packet->payload_packet_len >= 28 && packet->payload_packet_len <= 1200) && ((packet->payload[0] == 0x80) && ((packet->payload[1] == 0xc8) || (packet->payload[1] == 0xc9)) && (packet->payload[2] == 0x00))) - || (((packet->payload[0] == 0x81) && ((packet->payload[1] == 0xc8) || (packet->payload[1] == 0xc9)) + || (packet->payload_packet_len >= 3 && ((packet->payload[0] == 0x81) && ((packet->payload[1] == 0xc8) || (packet->payload[1] == 0xc9)) && (packet->payload[2] == 0x00)))) { NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "found rtcp.\n"); ndpi_int_rtcp_add_connection(ndpi_struct, flow); |