[sr-dev] git:master:7076904d: core: parse sdp - detect multipart invalid format

[Daniel-Constantin Mierla]

Module: kamailio
Branch: master
Commit: 7076904d0f0980d6bfa0814e3b1a8c61ee0acecc
URL: https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61ee0acecc

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date: 2022-03-11T21:36:16+01:00

core: parse sdp - detect multipart invalid format

---

Modified: src/core/parser/sdp/sdp.c

---

Diff:  https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61ee0acecc.diff
Patch: https://github.com/kamailio/kamailio/commit/7076904d0f0980d6bfa0814e3b1a8c61ee0acecc.patch

---

diff --git a/src/core/parser/sdp/sdp.c b/src/core/parser/sdp/sdp.c
index dc584e1c8b..d81413a0a5 100644
--- a/src/core/parser/sdp/sdp.c
+++ b/src/core/parser/sdp/sdp.c
@@ -685,6 +685,11 @@ static int parse_mixed_content(str *mixed_body, str delimiter, sdp_info_t* _sdp)
 			return -1;
 		}
 		d2p = find_next_sdp_line_delimiter(d1p, bodylimit, delimiter, bodylimit);
+		if((d1p + delimiter.len + 2 > bodylimit)
+				|| (d2p - d1p < delimiter.len + 2)) {
+			LM_ERR("invalid format [%.*s]\n", (int)(d2p-d1p), d1p);
+			return -1;
+		}
 		/* d2p is text limit for application parsing */
 		memset(&hf, 0, sizeof(struct hdr_field));
 		rest = eat_line(d1p + delimiter.len + 2, d2p - d1p - delimiter.len - 2);