Merge "AST-2018-002: Crash with an invalid SDP media format description"

This commit is contained in:
Kevin Harwell 2018-02-21 14:11:29 -06:00 committed by Gerrit Code Review
commit c166589207
1 changed files with 19 additions and 0 deletions

View File

@ -0,0 +1,19 @@
diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c
index a3dd80b..0a13206 100644
--- a/pjmedia/src/pjmedia/sdp.c
+++ b/pjmedia/src/pjmedia/sdp.c
@@ -1516,11 +1516,12 @@ PJ_DEF(pj_status_t) pjmedia_sdp_validate2(const pjmedia_sdp_session *sdp,
* RTC based programs sends "null" for instant messaging!
*/
if (pj_isdigit(*m->desc.fmt[j].ptr)) {
- unsigned pt = pj_strtoul(&m->desc.fmt[j]);
+ unsigned long pt;
+ pj_status_t status = pj_strtoul3(&m->desc.fmt[j], &pt, 10);
/* Payload type is between 0 and 127.
*/
- CHECK( pt <= 127, PJMEDIA_SDP_EINPT);
+ CHECK( status == PJ_SUCCESS && pt <= 127, PJMEDIA_SDP_EINPT);
/* If port is not zero, then for each dynamic payload type, an
* rtpmap attribute must be specified.