meetecho / janus-gateway

Janus WebRTC Server
https://janus.conf.meetecho.com
GNU General Public License v3.0
8.25k stars 2.48k forks source link

Limit sdp lines (Credit to OSS-Fuzz) #3414

Closed atoppi closed 2 months ago

atoppi commented 3 months ago

This PR is a workaround for an issue discovered by OSS-Fuzz when trying to parse a SDP with a large number of lines. Long story short, the g_strsplit function is not efficient when dealing with string with a lot of delimiter (\n) occurrences.

As a consequence we limit the number of SDP lines to 10000 in order to avoid the timeout on OSS-Fuzz and work around the issue in Janus. Of course this is not the optimal solution since we do not want to hardcode a number of lines. In the long term we plan to rewrite the splitting algorithm to avoid such inefficiencies.

atoppi commented 2 months ago

See #3424 for a proper fix.