diff options
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2014-1587-bug-1089207.patch')
| -rw-r--r-- | gnu/packages/patches/icecat-CVE-2014-1587-bug-1089207.patch | 119 |
1 files changed, 119 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2014-1587-bug-1089207.patch b/gnu/packages/patches/icecat-CVE-2014-1587-bug-1089207.patch new file mode 100644 index 0000000000..cd5602c86b --- /dev/null +++ b/gnu/packages/patches/icecat-CVE-2014-1587-bug-1089207.patch @@ -0,0 +1,119 @@ +commit 9df10fea93b483af6646ef2f7aab35598fbaab2f +Author: Nils Ohlmeier [:drno] <drno@ohlmeier.org> +Date: Thu Nov 6 12:21:57 2014 -0500 + + Bug 1089207: fix parsing of invalid fmtp att r=drno,jesup a=lmandel + + Modified media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c +diff --git a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c +index fa5ca2e..33d26c0 100644 +--- a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c ++++ b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_attr.c +@@ -458,7 +458,6 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p, + char tmp[SDP_MAX_STRING_LEN]; + char *src_ptr; + char *temp_ptr = NULL; +- tinybool flag=FALSE; + char *tok=NULL; + char *temp=NULL; + u16 custom_x=0; +@@ -495,29 +494,11 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p, + fmtp_p->packetization_mode = 0; + fmtp_p->level_asymmetry_allowed = SDP_DEFAULT_LEVEL_ASYMMETRY_ALLOWED_VALUE; + +- /* BEGIN - a typical macro fn to replace '/' with ';' from fmtp line*/ +- /* This ugly replacement of '/' with ';' is only done because +- * econf/MS client sends in this wierd /illegal format. +- * fmtp parameters MUST be separated by ';' +- */ + temp_ptr = cpr_strdup(ptr); + if (temp_ptr == NULL) { + return (SDP_FAILURE); + } + fmtp_ptr = src_ptr = temp_ptr; +- while (flag == FALSE) { +- if (*src_ptr == '\n') { +- flag = TRUE; +- break; +- } +- if (*src_ptr == '/') { +- *src_ptr =';' ; +- } +- src_ptr++; +- } +- /* END */ +- /* Once we move to RFC compliant video codec implementations, the above +- * patch should be removed */ + + src_ptr = temp_ptr; + while (!done) { + Modified media/webrtc/signaling/src/sipcc/core/sdp/sdp_main.c +diff --git a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_main.c b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_main.c +index 0be02aa..9760d4e 100644 +--- a/media/webrtc/signaling/src/sipcc/core/sdp/sdp_main.c ++++ b/media/webrtc/signaling/src/sipcc/core/sdp/sdp_main.c +@@ -1002,7 +1002,12 @@ sdp_result_e sdp_parse (sdp_t *sdp_p, char **bufp, u16 len) + */ + ptr = next_ptr; + line_end = sdp_findchar(ptr, "\n"); +- if (line_end >= (*bufp + len)) { ++ if ((line_end >= (*bufp + len)) || ++ (*line_end == '\0')) { ++ /* As this does not update the result value the SDP up to this point ++ * is still accept as valid. So encountering this is not treated as ++ * an error. ++ */ + sdp_parse_error(sdp_p->peerconnection, + "%s End of line beyond end of buffer.", + sdp_p->debug_str); + Modified media/webrtc/signaling/test/sdp_unittests.cpp +diff --git a/media/webrtc/signaling/test/sdp_unittests.cpp b/media/webrtc/signaling/test/sdp_unittests.cpp +index 51df09b..9f98eed 100644 +--- a/media/webrtc/signaling/test/sdp_unittests.cpp ++++ b/media/webrtc/signaling/test/sdp_unittests.cpp +@@ -755,13 +755,13 @@ TEST_F(SdpTest, parseFmtpMaxFs) { + u32 val = 0; + ParseSdp(kVideoSdp + "a=fmtp:120 max-fs=300;max-fr=30\r\n"); + ASSERT_EQ(sdp_attr_get_fmtp_max_fs(sdp_ptr_, 1, 0, 1, &val), SDP_SUCCESS); +- ASSERT_EQ(val, 300); ++ ASSERT_EQ(val, 300U); + } + TEST_F(SdpTest, parseFmtpMaxFr) { + u32 val = 0; + ParseSdp(kVideoSdp + "a=fmtp:120 max-fs=300;max-fr=30\r\n"); + ASSERT_EQ(sdp_attr_get_fmtp_max_fr(sdp_ptr_, 1, 0, 1, &val), SDP_SUCCESS); +- ASSERT_EQ(val, 30); ++ ASSERT_EQ(val, 30U); + } + + TEST_F(SdpTest, addFmtpMaxFs) { +@@ -789,6 +789,29 @@ TEST_F(SdpTest, addFmtpMaxFsFr) { + std::string::npos); + } + ++static const std::string kBrokenFmtp = ++ "v=0\r\n" ++ "o=- 137331303 2 IN IP4 127.0.0.1\r\n" ++ "s=SIP Call\r\n" ++ "t=0 0\r\n" ++ "m=video 56436 RTP/SAVPF 120\r\n" ++ "c=IN IP4 198.51.100.7\r\n" ++ "a=rtpmap:120 VP8/90000\r\n" ++ /* Note: the \0 in this string triggered bz://1089207 ++ */ ++ "a=fmtp:120 max-fs=300;max\0fr=30"; ++ ++TEST_F(SdpTest, parseBrokenFmtp) { ++ u32 val = 0; ++ char *buf = const_cast<char *>(kBrokenFmtp.data()); ++ ResetSdp(); ++ /* We need to manually invoke the parser here to be able to specify the length ++ * of the string beyond the \0 in last line of the string. ++ */ ++ ASSERT_EQ(sdp_parse(sdp_ptr_, &buf, 165), SDP_SUCCESS); ++ ASSERT_EQ(sdp_attr_get_fmtp_max_fs(sdp_ptr_, 1, 0, 1, &val), SDP_INVALID_PARAMETER); ++} ++ + } // End namespace test. + + int main(int argc, char **argv) { |