From 186d4f1a0babf24254cf6874579d83c30a55a8f1 Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Fri, 22 Dec 2023 02:44:22 +0100 Subject: [PATCH] client: allow MGCP_MAX_CODECS entries So far we allow only MGCP_MAX_CODECS-1 entries, because the parsing exit condition hits only after the array size check. Instead, check the array size a bit later, just before actually adding a valid entry. This is verified to work as expected in upcoming patch I842ce65a9a70f313570857b7df53727cc572b9e6 that adds a new mgcp_client_test.c section for this. Change-Id: I9a28da85e437f118026ea71a5a708e5758fff623 --- src/libosmo-mgcp-client/mgcp_client.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/libosmo-mgcp-client/mgcp_client.c b/src/libosmo-mgcp-client/mgcp_client.c index 60c54a65b..8df65cdc0 100644 --- a/src/libosmo-mgcp-client/mgcp_client.c +++ b/src/libosmo-mgcp-client/mgcp_client.c @@ -323,10 +323,6 @@ static int mgcp_parse_audio_port_pt(struct mgcp_response *r, char *line) pt_str = strtok(line, " "); while (1) { - /* Do not allow excessive payload types */ - if (ptmap_len >= ARRAY_SIZE(r->ptmap)) - goto response_parse_failure_pt; - pt_str = strtok(NULL, " "); if (!pt_str) break; @@ -344,6 +340,10 @@ static int mgcp_parse_audio_port_pt(struct mgcp_response *r, char *line) if (r->ptmap[i].pt == pt) goto response_parse_failure_pt; + /* Do not allow excessive payload types */ + if (ptmap_len >= ARRAY_SIZE(r->ptmap)) + goto response_parse_failure_pt; + /* Some payload type numbers imply a specific codec. For those, using the PT number as enum mgcp_codecs * yields the correct result. If no more specific information on the codec follows in "a=rtpmap:N" * lines, then this default number takes over. This only applies for PT below the dynamic range (<96). */