teaj / libjingle

Automatically exported from code.google.com/p/libjingle
0 stars 0 forks source link

pseudotcp incorrectly validates incoming packet size #437

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Send pseudotcp a packet between 13 and 19 bytes long

What is the expected output? What do you see instead?
pseudotcp tries to allocate huge amounts of memory and crashes

What version of the product are you using? On what operating system?
0.6.14

Please provide any additional information below.

This patch should fix the problem:
diff --git a/stacks/texas_videoconf/vcclient/relay/pseudo_tcp.cpp 
b/stacks/texas_videoconf/vcclient/relay/pseudo_tcp.cpp
--- a/stacks/texas_videoconf/vcclient/relay/pseudo_tcp.cpp
+++ b/stacks/texas_videoconf/vcclient/relay/pseudo_tcp.cpp
@@ -616,7 +616,7 @@
 }

 bool PseudoTcp::parse(const uint8_t* buffer, uint32_t size) {
-  if (size < 12)
+  if (size < HEADER_SIZE)
     return false;

   Segment seg;

Original issue reported on code.google.com by bla...@suitabletech.com on 23 May 2013 at 11:15