WebrtcAudioConduit::CodecConfigToWebRTCCodec improperly null-terminates |cinst.plname|

RESOLVED FIXED in mozilla33

Status

()

Core
WebRTC: Signaling
P3
normal
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: erahm, Assigned: jesup)

Tracking

({coverity})

Trunk
mozilla33
coverity
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [CID 749129])

Attachments

(1 attachment)

http://dxr.mozilla.org/mozilla-central/source/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp#866

#1 - There is a buffer overrun of 1 char if plName is 31 chars
#2 - Currently plname includes a trailing junk byte

We probably just need to subtract 1:
  cinst.plname[plNameLength-1]='\0';
(Assignee)

Comment 1

4 years ago
Created attachment 8440240 [details] [diff] [review]
fix issues with overlong codec names in AudioConduit
(Assignee)

Updated

4 years ago
Assignee: nobody → rjesup
(Assignee)

Updated

4 years ago
Attachment #8440240 - Flags: review?(pkerr)

Updated

4 years ago
Attachment #8440240 - Flags: review?(pkerr) → review+
(Assignee)

Comment 2

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/8c3f99209da5
Target Milestone: --- → mozilla33
Priority: -- → P3
https://hg.mozilla.org/mozilla-central/rev/8c3f99209da5
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.