mirrors/linphone-iphone
1
0
Fork 1
mirror of https://gitlab.linphone.org/BC/public/linphone-iphone.git synced 2026-01-17 19:18:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix invalid read/write in _linphone_call_params_clone()

Browse source
This commit is contained in:
François Grisez 2017-01-24 16:20:40 +01:00
parent cca80fbbe5
commit 5a8b07dee2
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
coreapi/call_params.c
View file

@ -340,11 +340,15 @@ static void _linphone_call_params_uninit(LinphoneCallParams *cp){
static void _linphone_call_params_clone(LinphoneCallParams *dst, const LinphoneCallParams *src) {
unsigned int i;
// WARNING: the structure is not copied entirely to avoid the belle_sip_object_t part to be corrupted.
memcpy(dst+sizeof(belle_sip_object_t),src+sizeof(belle_sip_object_t),sizeof(LinphoneCallParams)-sizeof(belle_sip_object_t));
/*
* Save the belle_sip_object_t part, copy the entire structure and restore the belle_sip_object_t part
*/
belle_sip_object_t tmp = dst->base;
memcpy(dst, src, sizeof(LinphoneCallParams));
dst->base = tmp;
if (src->record_file) dst->record_file=ms_strdup(src->record_file);
if (src->session_name) dst->session_name=ms_strdup(dst->session_name);
if (src->session_name) dst->session_name=ms_strdup(src->session_name);
/*
* The management of the custom headers is not optimal. We copy everything while ref counting would be more efficient.
*/