Commit de2653a6 authored by Mathieu Rene's avatar Mathieu Rene Committed by Pekka Pessi

FSCORE-551: fix crash encoding stun messages

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@16635 d0543943-73ff-0310-b7d9-9358b9ac24b2
parent 8dfcd942
......@@ -248,12 +248,11 @@ int process_3489_request(stun_mini_t *mini,
next = &response->stun_attr;
/* MAPPED-ADDRESS */
a = malloc(sizeof *a); if (!a) return STUN_500_SERVER_ERROR;
a = calloc(1, sizeof *a); if (!a) return STUN_500_SERVER_ERROR;
a->attr_type = MAPPED_ADDRESS;
addr = malloc(sizeof *addr); if (!addr) return STUN_500_SERVER_ERROR;
memcpy(addr, from, sizeof *addr);
a->pattr = addr;
a->next = NULL;
*next = a; next = &a->next;
/* SOURCE-ADDRESS */ /* depends on CHANGE_REQUEST */
......@@ -312,12 +311,11 @@ int process_3489_request(stun_mini_t *mini,
return STUN_500_SERVER_ERROR;
}
a = malloc(sizeof *a); if (!a) return STUN_500_SERVER_ERROR;
a = calloc(1, sizeof *a); if (!a) return STUN_500_SERVER_ERROR;
a->attr_type = SOURCE_ADDRESS;
addr = malloc(sizeof *addr); if (!addr) return STUN_500_SERVER_ERROR;
memcpy(addr, ss->ss_addr.array, sizeof *addr);
a->pattr = addr;
a->next = NULL;
*next = a; next = &(a->next);
if (changed) {
......@@ -369,7 +367,7 @@ int send_stun_error(stun_msg_t *response,
memcpy(response->stun_hdr.tran_id, transaction_id, 16);
/* ERROR-CODE */
attr = malloc(sizeof *attr); if (!attr) return -1;
attr = calloc(1, sizeof *attr); if (!attr) return -1;
response->stun_attr = attr;
attr->attr_type = ERROR_CODE;
......@@ -387,4 +385,3 @@ int send_stun_error(stun_msg_t *response,
return 0;
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment