neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-mgw/+/35420?usp=email )
Change subject: client: allow MGCP_MAX_CODECS entries ......................................................................
client: allow MGCP_MAX_CODECS entries
So far we allow only MGCP_MAX_CODECS-1 entries, because the parsing exit condition hits only after the array size check. Instead, check the array size a bit later, just before actually adding a valid entry.
This is verified to work as expected in upcoming patch I842ce65a9a70f313570857b7df53727cc572b9e6 that adds a new mgcp_client_test.c section for this.
Change-Id: I9a28da85e437f118026ea71a5a708e5758fff623 --- M src/libosmo-mgcp-client/mgcp_client.c 1 file changed, 21 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/20/35420/1
diff --git a/src/libosmo-mgcp-client/mgcp_client.c b/src/libosmo-mgcp-client/mgcp_client.c index 60c54a6..8df65cd 100644 --- a/src/libosmo-mgcp-client/mgcp_client.c +++ b/src/libosmo-mgcp-client/mgcp_client.c @@ -323,10 +323,6 @@
pt_str = strtok(line, " "); while (1) { - /* Do not allow excessive payload types */ - if (ptmap_len >= ARRAY_SIZE(r->ptmap)) - goto response_parse_failure_pt; - pt_str = strtok(NULL, " "); if (!pt_str) break; @@ -344,6 +340,10 @@ if (r->ptmap[i].pt == pt) goto response_parse_failure_pt;
+ /* Do not allow excessive payload types */ + if (ptmap_len >= ARRAY_SIZE(r->ptmap)) + goto response_parse_failure_pt; + /* Some payload type numbers imply a specific codec. For those, using the PT number as enum mgcp_codecs * yields the correct result. If no more specific information on the codec follows in "a=rtpmap:N" * lines, then this default number takes over. This only applies for PT below the dynamic range (<96). */