admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing stack buffer overflow (read) in SctpDataEngine.

Browse Source 
Was using the wrong size when memcpy'ing a sockaddr_conn.

BUG=chromium:642638
TBR=pthatcher@webrtc.org

Review URL: https://codereview.webrtc.org/2318653003 .

Cr-Commit-Position: refs/heads/master@{#14111}
This commit is contained in:
Taylor Brandstetter 2016-09-07 10:05:21 -07:00
parent 652ac89c09
commit a4d40cb502
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
webrtc/media/sctp/sctpdataengine.cc
View File

@ -550,8 +550,7 @@ bool SctpDataMediaChannel::Connect() {
// Set the MTU and disable MTU discovery.
// We can only do this after usrsctp_connect or it has no effect.
sctp_paddrparams params = {{0}};
memcpy(reinterpret_cast<sockaddr*>(&params.spp_address),
reinterpret_cast<sockaddr*>(&remote_sconn), sizeof(sockaddr));
memcpy(&params.spp_address, &remote_sconn, sizeof(remote_sconn));
params.spp_flags = SPP_PMTUD_DISABLE;
params.spp_pathmtu = kSctpMtu;
if (usrsctp_setsockopt(sock_, IPPROTO_SCTP, SCTP_PEER_ADDR_PARAMS, &params,