From 948af939464fa743a18b86af24ab0c85156311b9 Mon Sep 17 00:00:00 2001 From: Anthony Minessale Date: Thu, 11 May 2017 13:22:45 -0500 Subject: [PATCH] FS-10307: [freeswitch-core] Repetitive verto re-attach with video only channels can cause a buffer overflow #resolve Conflicts: src/switch_core_media.c --- src/switch_core_media.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/src/switch_core_media.c b/src/switch_core_media.c index bcf95cd205..88910fc515 100644 --- a/src/switch_core_media.c +++ b/src/switch_core_media.c @@ -3829,6 +3829,9 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s a_engine = &smh->engines[SWITCH_MEDIA_TYPE_AUDIO]; v_engine = &smh->engines[SWITCH_MEDIA_TYPE_VIDEO]; + smh->mparams->num_codecs = 0; + smh->num_negotiated_codecs = 0; + switch_core_media_prepare_codecs(session, SWITCH_TRUE); codec_array = smh->codecs; total_codecs = smh->mparams->num_codecs; @@ -4247,13 +4250,6 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s } - smh->mparams->num_codecs = 0; - smh->num_negotiated_codecs = 0; - switch_core_media_prepare_codecs(session, SWITCH_TRUE); - codec_array = smh->codecs; - total_codecs = smh->mparams->num_codecs; - - if (switch_rtp_has_dtls() && dtls_ok(session)) { for (attr = m->m_attributes; attr; attr = attr->a_next) { @@ -4565,8 +4561,8 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s match = 1; a_engine->codec_negotiated = 1; - for(j = 0; j < m_idx; j++) { - payload_map_t *pmap = switch_core_media_add_payload_map(session, + for(j = 0; j < m_idx && smh->num_negotiated_codecs < SWITCH_MAX_CODECS; j++) { + payload_map_t *pmap = switch_core_media_add_payload_map(session, SWITCH_MEDIA_TYPE_AUDIO, matches[j].map->rm_encoding, matches[j].imp->modname, @@ -5008,8 +5004,8 @@ SWITCH_DECLARE(uint8_t) switch_core_media_negotiate_sdp(switch_core_session_t *s vmatch = 1; v_engine->codec_negotiated = 1; - for(j = 0; j < m_idx; j++) { - payload_map_t *pmap = switch_core_media_add_payload_map(session, + for(j = 0; j < m_idx && smh->num_negotiated_codecs < SWITCH_MAX_CODECS; j++) { + payload_map_t *pmap = switch_core_media_add_payload_map(session, SWITCH_MEDIA_TYPE_VIDEO, matches[j].map->rm_encoding, matches[j].imp->modname,