Skip to content

Commit

Permalink
Merge pull request from GHSA-fq45-m3f7-3mhj
Browse files Browse the repository at this point in the history 
* Initial patch

* Use 'pj_scan_is_eof(scanner)'

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Use 'pj_scan_is_eof(scanner)'

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Use 'pj_scan_is_eof(scanner)'

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Use `!pj_scan_is_eof` instead of manually checking `scanner->curptr < scanner->end`

Co-authored-by: Maksim Mukosey <mmukosey@gmail.com>

* Update pjlib-util/src/pjlib-util/scanner.c

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Update pjlib-util/src/pjlib-util/scanner.c

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Update pjlib-util/src/pjlib-util/scanner.c

Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>

* Revert '>=' back to '>' in pj_scan_stricmp_alnum()

* Fix error compiles.

Co-authored-by: Nanang Izzuddin <nanang@teluu.com>
Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
Co-authored-by: Maksim Mukosey <mmukosey@gmail.com>
  • Loading branch information
@sauwming @nanangizz
@alichtman @eoff
4 people committed Oct 3, 2022
1 parent e948f48 commit c4d3498
Show file tree
Hide file tree
Showing 3 changed files with 48 additions and 28 deletions.
41 changes: 27 additions & 14 deletions pjlib-util/src/pjlib-util/scanner.c
View file
Expand Up @@ -195,7 +195,13 @@ PJ_DEF(void) pj_scan_skip_whitespace( pj_scanner *scanner )

PJ_DEF(void) pj_scan_skip_line( pj_scanner *scanner )
{
char *s = pj_memchr(scanner->curptr, '\n', scanner->end - scanner->curptr);
char *s;

if (pj_scan_is_eof(scanner)) {
return;
}

s = pj_memchr(scanner->curptr, '\n', scanner->end - scanner->curptr);
if (!s) {
scanner->curptr = scanner->end;
} else {
Expand Down Expand Up @@ -264,8 +270,7 @@ PJ_DEF(void) pj_scan_get( pj_scanner *scanner,

pj_assert(pj_cis_match(spec,0)==0);

/* EOF is detected implicitly */
if (!pj_cis_match(spec, *s)) {
if (pj_scan_is_eof(scanner) || !pj_cis_match(spec, *s)) {
pj_scan_syntax_err(scanner);
return;
}
Expand Down Expand Up @@ -299,8 +304,7 @@ PJ_DEF(void) pj_scan_get_unescape( pj_scanner *scanner,
/* Must not match character '%' */
pj_assert(pj_cis_match(spec,'%')==0);

/* EOF is detected implicitly */
if (!pj_cis_match(spec, *s) && *s != '%') {
if (pj_scan_is_eof(scanner) || !pj_cis_match(spec, *s) && *s != '%') {
pj_scan_syntax_err(scanner);
return;
}
Expand Down Expand Up @@ -436,7 +440,9 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,

scanner->curptr += N;

if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
if (!pj_scan_is_eof(scanner) &&
PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
}
Expand Down Expand Up @@ -467,15 +473,16 @@ PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )

PJ_DEF(void) pj_scan_get_newline( pj_scanner *scanner )
{
if (!PJ_SCAN_IS_NEWLINE(*scanner->curptr)) {
if (pj_scan_is_eof(scanner) || !PJ_SCAN_IS_NEWLINE(*scanner->curptr)) {
pj_scan_syntax_err(scanner);
return;
}

/* We have checked scanner->curptr validity above */
if (*scanner->curptr == '\r') {
++scanner->curptr;
}
if (*scanner->curptr == '\n') {
if (!pj_scan_is_eof(scanner) && *scanner->curptr == '\n') {
++scanner->curptr;
}

Expand Down Expand Up @@ -520,7 +527,9 @@ PJ_DEF(void) pj_scan_get_until( pj_scanner *scanner,

scanner->curptr = s;

if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
scanner->skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
}
Expand All @@ -544,7 +553,9 @@ PJ_DEF(void) pj_scan_get_until_ch( pj_scanner *scanner,

scanner->curptr = s;

if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
scanner->skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
}
Expand All @@ -570,7 +581,9 @@ PJ_DEF(void) pj_scan_get_until_chr( pj_scanner *scanner,

scanner->curptr = s;

if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
scanner->skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
}
Expand All @@ -585,7 +598,9 @@ PJ_DEF(void) pj_scan_advance_n( pj_scanner *scanner,

scanner->curptr += N;

if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && skip_ws) {
if (!pj_scan_is_eof(scanner) &&
PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
}
Expand Down Expand Up @@ -636,5 +651,3 @@ PJ_DEF(void) pj_scan_restore_state( pj_scanner *scanner,
scanner->line = state->line;
scanner->start_line = state->start_line;
}


11 changes: 7 additions & 4 deletions pjmedia/src/pjmedia/rtp.c
View file
Expand Up @@ -188,6 +188,11 @@ PJ_DEF(pj_status_t) pjmedia_rtp_decode_rtp2(
/* Payload is located right after header plus CSRC */
offset = sizeof(pjmedia_rtp_hdr) + ((*hdr)->cc * sizeof(pj_uint32_t));

/* Check that offset is less than packet size */
if (offset >= pkt_len) {
return PJMEDIA_RTP_EINLEN;
}

/* Decode RTP extension. */
if ((*hdr)->x) {
if (offset + sizeof (pjmedia_rtp_ext_hdr) > (unsigned)pkt_len)
Expand All @@ -202,8 +207,8 @@ PJ_DEF(pj_status_t) pjmedia_rtp_decode_rtp2(
dec_hdr->ext_len = 0;
}

/* Check that offset is less than packet size */
if (offset > pkt_len)
/* Check again that offset is still less than packet size */
if (offset >= pkt_len)
return PJMEDIA_RTP_EINLEN;

/* Find and set payload. */
Expand Down Expand Up @@ -393,5 +398,3 @@ void pjmedia_rtp_seq_update( pjmedia_rtp_seq_session *sess,
seq_status->status.value = st.status.value;
}
}


24 changes: 14 additions & 10 deletions pjmedia/src/pjmedia/sdp.c
View file
Expand Up @@ -983,13 +983,13 @@ static void parse_version(pj_scanner *scanner,
ctx->last_error = PJMEDIA_SDP_EINVER;

/* check equal sign */
if (*(scanner->curptr+1) != '=') {
if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return;
}

/* check version is 0 */
if (*(scanner->curptr+2) != '0') {
if (scanner->curptr+2 >= scanner->end || *(scanner->curptr+2) != '0') {
on_scanner_error(scanner);
return;
}
Expand All @@ -1006,7 +1006,7 @@ static void parse_origin(pj_scanner *scanner, pjmedia_sdp_session *ses,
ctx->last_error = PJMEDIA_SDP_EINORIGIN;

/* check equal sign */
if (*(scanner->curptr+1) != '=') {
if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return;
}
Expand Down Expand Up @@ -1052,7 +1052,7 @@ static void parse_time(pj_scanner *scanner, pjmedia_sdp_session *ses,
ctx->last_error = PJMEDIA_SDP_EINTIME;

/* check equal sign */
if (*(scanner->curptr+1) != '=') {
if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return;
}
Expand Down Expand Up @@ -1080,7 +1080,7 @@ static void parse_generic_line(pj_scanner *scanner, pj_str_t *str,
ctx->last_error = PJMEDIA_SDP_EINSDP;

/* check equal sign */
if (*(scanner->curptr+1) != '=') {
if ((scanner->curptr+1 >= scanner->end) || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return;
}
Expand Down Expand Up @@ -1149,7 +1149,7 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
ctx->last_error = PJMEDIA_SDP_EINMEDIA;

/* check the equal sign */
if (*(scanner->curptr+1) != '=') {
if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return;
}
Expand All @@ -1164,6 +1164,10 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
/* port */
pj_scan_get(scanner, &cs_token, &str);
med->desc.port = (unsigned short)pj_strtoul(&str);
if (pj_scan_is_eof(scanner)) {
on_scanner_error(scanner);
return;
}
if (*scanner->curptr == '/') {
/* port count */
pj_scan_get_char(scanner);
Expand All @@ -1175,15 +1179,15 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
}

if (pj_scan_get_char(scanner) != ' ') {
PJ_THROW(SYNTAX_ERROR);
on_scanner_error(scanner);
}

/* transport */
pj_scan_get_until_chr(scanner, " \t\r\n", &med->desc.transport);

/* format list */
med->desc.fmt_count = 0;
while (*scanner->curptr == ' ') {
while (scanner->curptr < scanner->end && *scanner->curptr == ' ') {
pj_str_t fmt;

pj_scan_get_char(scanner);
Expand Down Expand Up @@ -1223,7 +1227,7 @@ static pjmedia_sdp_attr *parse_attr( pj_pool_t *pool, pj_scanner *scanner,
attr = PJ_POOL_ALLOC_T(pool, pjmedia_sdp_attr);

/* check equal sign */
if (*(scanner->curptr+1) != '=') {
if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
on_scanner_error(scanner);
return NULL;
}
Expand All @@ -1242,7 +1246,7 @@ static pjmedia_sdp_attr *parse_attr( pj_pool_t *pool, pj_scanner *scanner,
pj_scan_get_char(scanner);

/* get value */
if (*scanner->curptr != '\r' && *scanner->curptr != '\n') {
if (!pj_scan_is_eof(scanner) && *scanner->curptr != '\r' && *scanner->curptr != '\n') {
pj_scan_get_until_chr(scanner, "\r\n", &attr->value);
} else {
attr->value.ptr = NULL;
Expand Down

0 comments on commit c4d3498

Please sign in to comment.