From 1f69c0373906e24b229dc2d0839a5d3c8b45250d Mon Sep 17 00:00:00 2001 From: "mflodman@webrtc.org" Date: Tue, 15 Nov 2011 06:12:39 +0000 Subject: [PATCH] Added size sanity check for copying app specific RTCP data. Similar check as done in RTCPUtility::RTCPParserV2::ParseAPPItem. Review URL: http://webrtc-codereview.appspot.com/277002 git-svn-id: http://webrtc.googlecode.com/svn/trunk@942 4adac7df-926f-26a2-2b94-8c16560cd09d --- src/modules/rtp_rtcp/source/rtcp_receiver_help.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/modules/rtp_rtcp/source/rtcp_receiver_help.cc b/src/modules/rtp_rtcp/source/rtcp_receiver_help.cc index 359851efac..0858d2b396 100644 --- a/src/modules/rtp_rtcp/source/rtcp_receiver_help.cc +++ b/src/modules/rtp_rtcp/source/rtcp_receiver_help.cc @@ -56,6 +56,11 @@ RTCPPacketInformation::AddApplicationData(const WebRtc_UWord8* data, const WebRt WebRtc_UWord8* oldData = applicationData; WebRtc_UWord16 oldLength = applicationLength; + // Don't copy more than kRtcpAppCode_DATA_SIZE bytes. + if (size > kRtcpAppCode_DATA_SIZE) { + size = kRtcpAppCode_DATA_SIZE; + } + applicationLength += size; applicationData = new WebRtc_UWord8[applicationLength];