cellular-infrastructure
/
osmo-mgw
mirror of https://gerrit.osmocom.org/osmo-mgw
10
0
Fork 0
Code Issues Releases Wiki Activity

Fix return variable of strtoul() 

Return variable specified by strtoul() is "unsigned long int". If
"unsigned int" is used, according to Coverity the return value can never
be ULONG_MAX:

CID 202173:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)
"pt == 18446744073709551615UL /* 9223372036854775807L * 2UL + 1UL */" is always false regardless of the values of its operands. This occurs as the logical second operand of "&&".

Furthermore, PT is 7 bit in RTP header [1], so let's avoid accepting
incorrect values.

[1] https://tools.ietf.org/html/rfc3550#section-5

Fixes: c5c1430a1c ("Catch unsigned integer MGCP parsing errors with strtoul")
Fixes: Coverity CID#202172
FIxes: Coverity CID#202173
Change-Id: Ice9eee6a252fab73dbab5ebf3cfc83c1b354fd08
This commit is contained in:
Pau Espin 2019-07-26 14:13:14 +02:00
parent c5c1430a1c
commit a2b1c5e6f6
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/libosmo-mgcp-client/mgcp_client.c
View File

@ -268,7 +268,7 @@ static int mgcp_parse_audio_port_pt(struct mgcp_response *r, char *line)
{
char *pt_str;
char *pt_end;
unsigned int pt;
unsigned long int pt;
unsigned int count = 0;
unsigned int i;
@ -298,6 +298,9 @@ static int mgcp_parse_audio_port_pt(struct mgcp_response *r, char *line)
pt_str == pt_end)
goto response_parse_failure_pt;
if (pt >> 7) /* PT is 7 bit field, higher values not allowed */
goto response_parse_failure_pt;
/* Do not allow duplicate payload types */
for (i = 0; i < count; i++)
if (r->codecs[i] == pt)

5
src/libosmo-mgcp/mgcp_sdp.c
View File

@ -132,7 +132,7 @@ static int pt_from_sdp(void *ctx, struct sdp_rtp_map *codecs,
char *str_ptr;
char *pt_str;
char *pt_end;
unsigned int pt;
unsigned long int pt;
unsigned int count = 0;
unsigned int i;
@ -163,6 +163,9 @@ static int pt_from_sdp(void *ctx, struct sdp_rtp_map *codecs,
pt_str == pt_end)
goto error;
if (pt >> 7) /* PT is 7 bit field, higher values not allowed */
goto error;
/* Do not allow duplicate payload types */
for (i = 0; i < count; i++)
if (codecs[i].payload_type == pt)