Fix list parsing bug in sdp_set_supp_features
When the data is a string or a sequence, it is not ok to dereference
data->val because it is already a pointer. Additionally a lengths
variable is added because the strings are not terminated with '\0' and
otherwise it would not be possible to know their length.
diff --git a/lib/sdp.c b/lib/sdp.c
index 5f1f2fc..aa22c63 100644
--- a/lib/sdp.c
+++ b/lib/sdp.c
@@ -4709,6 +4709,7 @@
for (p = sf, i = 0; p; p = p->next, i++) {
int plen, j;
void **dtds, **vals;
+ int *lengths;
plen = sdp_list_len(p->data);
dtds = malloc(plen * sizeof(void *));
@@ -4719,14 +4720,42 @@
free(dtds);
goto fail;
}
+ lengths = malloc(plen * sizeof(int *));
+ if (!lengths) {
+ free(dtds);
+ free(vals);
+ goto fail;
+ }
for (r = p->data, j = 0; r; r = r->next, j++) {
sdp_data_t *data = (sdp_data_t*)r->data;
dtds[j] = &data->dtd;
- vals[j] = &data->val;
+ switch (data->dtd) {
+ case SDP_URL_STR8:
+ case SDP_URL_STR16:
+ case SDP_TEXT_STR8:
+ case SDP_TEXT_STR16:
+ vals[j] = data->val.str;
+ lengths[j] = data->unitSize - sizeof(uint8_t);
+ break;
+ case SDP_ALT8:
+ case SDP_ALT16:
+ case SDP_ALT32:
+ case SDP_SEQ8:
+ case SDP_SEQ16:
+ case SDP_SEQ32:
+ vals[j] = data->val.dataseq;
+ lengths[j] = 0;
+ break;
+ default:
+ vals[j] = &data->val;
+ lengths[j] = 0;
+ break;
+ }
}
- feat = sdp_seq_alloc(dtds, vals, plen);
+ feat = sdp_seq_alloc_with_length(dtds, vals, lengths, plen);
free(dtds);
free(vals);
+ free(lengths);
if (!feat)
goto fail;
seqDTDs[i] = &feat->dtd;
