Merge pull request #2549 from signalwire/stun_overrun

[Core] switch_stun.c: Coverity 1468480: Out-of-bounds access (OVERRUN)
signalwire · Jul 30, 2024 · d569ca0 · d569ca0
2 parents 05e58fa + 9f7c64b
commit d569ca0
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/src/include/switch_stun.h b/src/include/switch_stun.h
@@ -141,6 +141,13 @@ typedef struct {
 	uint32_t address;
 } switch_stun_ip_t;
 
+typedef struct {
+	uint8_t wasted;
+	uint8_t family;
+	uint16_t port;
+	uint8_t address[16];
+} switch_stun_ipv6_t;
+
 #if SWITCH_BYTE_ORDER == __BIG_ENDIAN
 
 typedef struct {

diff --git a/src/switch_stun.c b/src/switch_stun.c
@@ -401,13 +401,17 @@ SWITCH_DECLARE(uint8_t) switch_stun_packet_attribute_get_mapped_address(switch_s
 SWITCH_DECLARE(uint8_t) switch_stun_packet_attribute_get_xor_mapped_address(switch_stun_packet_attribute_t *attribute, switch_stun_packet_header_t *header, char *ipstr, switch_size_t iplen, uint16_t *port)
 {
 	switch_stun_ip_t *ip;
+	switch_stun_ipv6_t *ipv6;
 	uint8_t x, *i;
 	char *p = ipstr;
 
 	ip = (switch_stun_ip_t *) attribute->value;
 
 	if (ip->family == 2) {
-		uint8_t *v6addr = (uint8_t *) &ip->address;
+		uint8_t *v6addr;
+
+		ipv6 = (switch_stun_ipv6_t *)attribute->value;
+		v6addr = (uint8_t *) &ipv6->address;
 		v6_xor(v6addr, (uint8_t *)header->id);
 		inet_ntop(AF_INET6, v6addr, ipstr, iplen);
 	} else {