Commit 6b1eec06 authored by Jakub Adam's avatar Jakub Adam Committed by Olivier Crête

udp-turn: Avoid potential integer overflow

parent 603ab1d4
......@@ -362,7 +362,7 @@ socket_recv_messages (NiceSocket *sock,
guint f_buffer_len = priv->fragment_buffer->len;
for (i = 0; i < n_recv_messages && f_buffer_len >= sizeof (guint16); ++i) {
guint16 msg_len = ((f_buffer[0] << 8) | f_buffer[1]) + sizeof (guint16);
guint32 msg_len = ((f_buffer[0] << 8) | f_buffer[1]) + sizeof (guint16);
if (msg_len > f_buffer_len) {
/* The next message in the buffer isn't complete yet. Wait for more
......@@ -450,7 +450,7 @@ socket_recv_messages (NiceSocket *sock,
if (nice_socket_is_reliable (sock) && parsed_buffer_length > 0) {
/* Determine the portion of the current NiceInputMessage we can already
* return. */
guint16 msg_len = 0;
gint32 msg_len = 0;
if (!priv->fragment_buffer) {
msg_len = ((buffer[0] << 8) | buffer[1]) + sizeof (guint16);
if (msg_len > parsed_buffer_length) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment