From b52d10d7abc522ec65786416ae7956e979855167 Mon Sep 17 00:00:00 2001 From: Anderson Lizardo Date: Fri, 15 Feb 2013 11:07:54 -0400 Subject: [PATCH] lib: Validate DTDs when parsing VersionNumberList --- lib/sdp.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/sdp.c b/lib/sdp.c index 61598bb97..6c73818f6 100644 --- a/lib/sdp.c +++ b/lib/sdp.c @@ -2155,9 +2155,24 @@ int sdp_get_server_ver(const sdp_record_t *rec, sdp_list_t **u16) errno = ENODATA; return -1; } - for (curr = d->val.dataseq; curr; curr = curr->next) + + if (!SDP_IS_SEQ(d->dtd) || d->val.dataseq == NULL) + goto invalid; + + for (curr = d->val.dataseq; curr; curr = curr->next) { + if (curr->dtd != SDP_UINT16) + goto invalid; *u16 = sdp_list_append(*u16, &curr->val.uint16); + } + return 0; + +invalid: + sdp_list_free(*u16, NULL); + *u16 = NULL; + errno = EINVAL; + + return -1; } /* flexible extraction of basic attributes - Jean II */ -- 2.11.0