Module: kamailio Branch: 6.0 Commit: d3d62bde97a86faa7dd1189bf10b697f28d84a63 URL: https://github.com/kamailio/kamailio/commit/d3d62bde97a86faa7dd1189bf10b697f28d84a63
Author: Daniel-Constantin Mierla <mico...@gmail.com> Committer: Daniel-Constantin Mierla <mico...@gmail.com> Date: 2025-04-09T09:28:14+02:00 parser/sdp: check if value is exceeded when looking for o= version field (cherry picked from commit c532a67db654efb21f81e058b7e3a86229766a40) --- Modified: src/core/parser/sdp/sdp_helpr_funcs.c --- Diff: https://github.com/kamailio/kamailio/commit/d3d62bde97a86faa7dd1189bf10b697f28d84a63.diff Patch: https://github.com/kamailio/kamailio/commit/d3d62bde97a86faa7dd1189bf10b697f28d84a63.patch --- diff --git a/src/core/parser/sdp/sdp_helpr_funcs.c b/src/core/parser/sdp/sdp_helpr_funcs.c index 893ef0e58a4..5e9b3f121ab 100644 --- a/src/core/parser/sdp/sdp_helpr_funcs.c +++ b/src/core/parser/sdp/sdp_helpr_funcs.c @@ -735,7 +735,12 @@ int extract_sess_version(str *oline, str *sess_version) } i++; - } while(len < oline->len && i < 3); + } while((cp < oline->s + oline->len) && i < 3); + + if(cp >= oline->s + oline->len) { + LM_ERR("broken o= line - version field not found\n"); + return -1; + } len = cp - cp0 - 1; LM_DBG("end %d: >%.*s<\n", len, len, cp0); _______________________________________________ Kamailio - Development Mailing List -- sr-dev@lists.kamailio.org To unsubscribe send an email to sr-dev-le...@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender!
