Closed Bug 1025343 Opened 6 years ago Closed 6 years ago

WebrtcAudioConduit::CodecConfigToWebRTCCodec improperly null-terminates |cinst.plname|

Categories

(Core :: WebRTC: Signaling, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla33

People

(Reporter: erahm, Assigned: jesup)

References

(Blocks 1 open bug)

Details

(Keywords: coverity, Whiteboard: [CID 749129])

Attachments

(1 file)

http://dxr.mozilla.org/mozilla-central/source/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp#866

#1 - There is a buffer overrun of 1 char if plName is 31 chars
#2 - Currently plname includes a trailing junk byte

We probably just need to subtract 1:
  cinst.plname[plNameLength-1]='\0';
Assignee: nobody → rjesup
Attachment #8440240 - Flags: review?(pkerr)
Attachment #8440240 - Flags: review?(pkerr) → review+
Priority: -- → P3
https://hg.mozilla.org/mozilla-central/rev/8c3f99209da5
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.