Mirror/ZLMediaKit
1
0
Fork 0
mirror of https://github.com/ZLMediaKit/ZLMediaKit.git synced 2026-06-12 19:24:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

修正SctpAssociation.cpp的访问越界 (#3182)

Browse Source 
ZLMediaKit/ZLMediaKit#3181
This commit is contained in:
sandro-qiang
2024-01-05 15:33:51 +08:00
committed by GitHub
parent b6cbbb4339
commit aeda47ec8c
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
webrtc/SctpAssociation.cpp
View File

@@ -677,9 +677,9 @@ namespace RTC
if (notification->sn_header.sn_length > 0)
{
static const size_t BufferSize{ 1024 };
static char buffer[BufferSize];
thread_local static char buffer[BufferSize];
uint32_t len = notification->sn_header.sn_length;
uint32_t len = notification->sn_assoc_change.sac_length - sizeof(struct sctp_assoc_change);
for (uint32_t i{ 0 }; i < len; ++i)
{
@@ -745,9 +745,9 @@ namespace RTC
if (notification->sn_header.sn_length > 0)
{
static const size_t BufferSize{ 1024 };
static char buffer[BufferSize];
thread_local static char buffer[BufferSize];
uint32_t len = notification->sn_header.sn_length;
uint32_t len = notification->sn_assoc_change.sac_length - sizeof(struct sctp_assoc_change);
for (uint32_t i{ 0 }; i < len; ++i)
{
@@ -786,7 +786,7 @@ namespace RTC
case SCTP_REMOTE_ERROR:
{
static const size_t BufferSize{ 1024 };
static char buffer[BufferSize];
thread_local static char buffer[BufferSize];
uint32_t len = notification->sn_remote_error.sre_length - sizeof(struct sctp_remote_error);
@@ -822,7 +822,7 @@ namespace RTC
case SCTP_SEND_FAILED_EVENT:
{
static const size_t BufferSize{ 1024 };
static char buffer[BufferSize];
thread_local static char buffer[BufferSize];
uint32_t len =
notification->sn_send_failed_event.ssfe_length - sizeof(struct sctp_send_failed_event);
@@ -1004,4 +1004,4 @@ namespace RTC
} // namespace RTC
#endif //ENABLE_SCTP
#endif //ENABLE_SCTP