Merged revisions 109386 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r109386 | file | 2008-03-18 11:58:39 -0300 (Tue, 18 Mar 2008) | 3 lines

Put a maximum limit on the number of payloads accepted, and also make sure a given payload does not exceed our maximum value.
(AST-2008-002)

........

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@109390 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index f6dcfa5..77bbb72 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -244,6 +244,8 @@ static int expiry = DEFAULT_EXPIRY;
 #define DEFAULT_MAX_SE               1800             /*!< Session-Timer Default Session-Expires period (RFC 4028) */
 #define DEFAULT_MIN_SE               90               /*!< Session-Timer Default Min-SE period (RFC 4028) */
 
+#define SDP_MAX_RTPMAP_CODECS        32               /*!< Maximum number of codecs allowed in received SDP */
+
 /*! \brief Global jitterbuffer configuration - by default, jb is disabled */
 static struct ast_jb_conf default_jbconf =
 {
@@ -6334,7 +6336,7 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
        int numberofmediastreams = 0;
        int debug = sip_debug_test_pvt(p);
                
-       int found_rtpmap_codecs[32];
+       int found_rtpmap_codecs[SDP_MAX_RTPMAP_CODECS];
        int last_rtpmap_codec=0;
 
        char buf[SIPBUFSIZE];
@@ -6684,36 +6686,41 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                } else if (sscanf(a, "rtpmap: %u %[^/]/", &codec, mimeSubtype) == 2) {
                        /* We have a rtpmap to handle */
 
-                       /* Note: should really look at the 'freq' and '#chans' params too */
-                       /* Note: This should all be done in the context of the m= above */
-                       if (!strncasecmp(mimeSubtype, "H26", 3) || !strncasecmp(mimeSubtype, "MP4", 3)) {         /* Video */
-                               if(ast_rtp_set_rtpmap_type(newvideortp, codec, "video", mimeSubtype, 0) != -1) {
-                                       if (debug)
-                                               ast_verbose("Found video description format %s for ID %d\n", mimeSubtype, codec);
-                                       found_rtpmap_codecs[last_rtpmap_codec] = codec;
-                                       last_rtpmap_codec++;
-                               } else {
-                                       ast_rtp_unset_m_type(newvideortp, codec);
-                                       if (debug) 
-                                               ast_verbose("Found unknown media description format %s for ID %d\n", mimeSubtype, codec);
-                               }
-                       } else if (!strncasecmp(mimeSubtype, "T140", 4)) { /* Text */
-                               if (p->trtp) {
-                                       /* ast_verbose("Adding t140 mimeSubtype to textrtp struct\n"); */
-                                       ast_rtp_set_rtpmap_type(newtextrtp, codec, "text", mimeSubtype, 0);
-                               }
-                       } else {                                          /* Must be audio?? */
-                               if(ast_rtp_set_rtpmap_type(newaudiortp, codec, "audio", mimeSubtype,
-                                               ast_test_flag(&p->flags[0], SIP_G726_NONSTANDARD) ? AST_RTP_OPT_G726_NONSTANDARD : 0) != -1) {
-                                       if (debug)
-                                               ast_verbose("Found audio description format %s for ID %d\n", mimeSubtype, codec);
-                                       found_rtpmap_codecs[last_rtpmap_codec] = codec;
-                                       last_rtpmap_codec++;
-                               } else {
-                                       ast_rtp_unset_m_type(newaudiortp, codec);
-                                       if (debug) 
-                                               ast_verbose("Found unknown media description format %s for ID %d\n", mimeSubtype, codec);
+                       if (last_rtpmap_codec < SDP_MAX_RTPMAP_CODECS) {
+                               /* Note: should really look at the 'freq' and '#chans' params too */
+                               /* Note: This should all be done in the context of the m= above */
+                               if (!strncasecmp(mimeSubtype, "H26", 3) || !strncasecmp(mimeSubtype, "MP4", 3)) {         /* Video */
+                                       if(ast_rtp_set_rtpmap_type(newvideortp, codec, "video", mimeSubtype, 0) != -1) {
+                                               if (debug)
+                                                       ast_verbose("Found video description format %s for ID %d\n", mimeSubtype, codec);
+                                               found_rtpmap_codecs[last_rtpmap_codec] = codec;
+                                               last_rtpmap_codec++;
+                                       } else {
+                                               ast_rtp_unset_m_type(newvideortp, codec);
+                                               if (debug) 
+                                                       ast_verbose("Found unknown media description format %s for ID %d\n", mimeSubtype, codec);
+                                       }
+                               } else if (!strncasecmp(mimeSubtype, "T140", 4)) { /* Text */
+                                       if (p->trtp) {
+                                               /* ast_verbose("Adding t140 mimeSubtype to textrtp struct\n"); */
+                                               ast_rtp_set_rtpmap_type(newtextrtp, codec, "text", mimeSubtype, 0);
+                                       }
+                               } else {                                          /* Must be audio?? */
+                                       if(ast_rtp_set_rtpmap_type(newaudiortp, codec, "audio", mimeSubtype,
+                                                                  ast_test_flag(&p->flags[0], SIP_G726_NONSTANDARD) ? AST_RTP_OPT_G726_NONSTANDARD : 0) != -1) {
+                                               if (debug)
+                                                       ast_verbose("Found audio description format %s for ID %d\n", mimeSubtype, codec);
+                                               found_rtpmap_codecs[last_rtpmap_codec] = codec;
+                                               last_rtpmap_codec++;
+                                       } else {
+                                               ast_rtp_unset_m_type(newaudiortp, codec);
+                                               if (debug) 
+                                                       ast_verbose("Found unknown media description format %s for ID %d\n", mimeSubtype, codec);
+                                       }
                                }
+                       } else {
+                               if (debug)
+                                       ast_verbose("Discarded description format %s for ID %d\n", mimeSubtype, codec);
                        }
 
                }

diff --git a/main/rtp.c b/main/rtp.c
index 1199ffb..4fcf747 100644 (file)
--- a/main/rtp.c
+++ b/main/rtp.c
@@ -1976,6 +1976,9 @@ void ast_rtp_set_m_type(struct ast_rtp* rtp, int pt)
        an unknown media type */
 void ast_rtp_unset_m_type(struct ast_rtp* rtp, int pt) 
 {
+       if (pt < 0 || pt > MAX_RTP_PT)
+               return; /* bogus payload type */
+
        rtp_bridge_lock(rtp);
        rtp->current_RTP_PT[pt].isAstFormat = 0;
        rtp->current_RTP_PT[pt].code = 0;