Skip to content

Commit

Permalink
parse_uri: Complete the fix for undefined bitwise left-shift (OSS-Fuzz)
Browse files Browse the repository at this point in the history
The default auto-cast to (int) is not enough, as a value such as
255 << 24 can still overflow the 31 value bits...

Fixes OSS-Fuzz#51542

(cherry picked from commit e0d90ec)
  • Loading branch information
liviuchircu committed Oct 10, 2022
1 parent 0c2e700 commit c46af85
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions parser/parse_uri.c
Original file line number Diff line number Diff line change
Expand Up @@ -659,8 +659,10 @@ int parse_uri(char* buf, int len, struct sip_uri* uri)
memset(uri, 0, sizeof(struct sip_uri)); /* zero it all, just to be sure*/
/*look for sip:, sips: or tel:*/
if (len<5) goto error_too_short;
scheme=(unsigned char)buf[0]+((unsigned char)buf[1]<<8)+
((unsigned char)buf[2]<<16)+((unsigned char)buf[3]<<24);
scheme=(unsigned)(unsigned char)buf[0]
+ (((unsigned)(unsigned char)buf[1])<<8)
+ (((unsigned)(unsigned char)buf[2])<<16)
+ (((unsigned)(unsigned char)buf[3])<<24);
scheme|=0x20202020;
if (scheme==SIP_SCH){
uri->type=SIP_URI_T;
Expand Down

0 comments on commit c46af85

Please sign in to comment.