Skip to content
Permalink
Browse files Browse the repository at this point in the history
Merge pull request from GHSA-26j7-ww69-c4qj
  • Loading branch information
sauwming committed Jun 7, 2022
1 parent 0cdd34c commit 450baca
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion pjlib-util/src/pjlib-util/stun_simple.c
Expand Up @@ -54,6 +54,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
{
pj_uint16_t msg_type, msg_len;
char *p_attr;
int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);

PJ_CHECK_STACK();

Expand Down Expand Up @@ -83,7 +84,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
msg->attr_count = 0;
p_attr = (char*)buf + sizeof(pjstun_msg_hdr);

while (msg_len > 0) {
while (msg_len > 0 && msg->attr_count < attr_max_cnt) {
pjstun_attr_hdr **attr = &msg->attr[msg->attr_count];
pj_uint32_t len;
pj_uint16_t attr_type;
Expand Down Expand Up @@ -111,6 +112,10 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
p_attr += len;
++msg->attr_count;
}
if (msg->attr_count == attr_max_cnt) {
PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.",
attr_max_cnt));
}

return PJ_SUCCESS;
}
Expand Down

0 comments on commit 450baca

Please sign in to comment.