818292 - Unchecked memcpy in nr_stun_msg_create2

Status: RESOLVED DUPLICATE of bug 818293

(Core :: WebRTC: Networking, defect)

Description

[Eric Rescorla (:ekr)]

The following code is very unsafe. We need to check length somewhere
or alternately truncate to the buffer length.

int
nr_stun_message_create2(nr_stun_message **msg, UCHAR *buffer, int length)
{
    int r,_status;
    nr_stun_message *m = 0;

    if ((r=nr_stun_message_create(&m)))
        ABORT(r);

    memcpy(m->buffer, buffer, length);
    m->length = length;

    *msg = m;

    _status=0;
  abort:
    return(_status);
}