Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(34)

Issue 2071873002: Fix buffer overflow in HMAC validation of STUN messages. (Closed)

Created:
4 years, 6 months ago by katrielc1
Modified:
4 years, 6 months ago
Reviewers:
Sergey Ulanov, katrielc
CC:
webrtc-reviews_webrtc.org, tterriberry_mozilla.com, pbos-webrtc, phoglund
Base URL:
https://chromium.googlesource.com/external/webrtc.git@master
Target Ref:
refs/pending/heads/master
Project:
webrtc
Visibility:
Public.

Description

Fix buffer overflow in HMAC validation of STUN messages. Committed: https://crrev.com/1a2061076412a08f3e4da04a2b33c3795e30b954 Cr-Commit-Position: refs/heads/master@{#13215}

Patch Set 1 #

Total comments: 4

Patch Set 2 : Add unit tests and extra header check. #

Total comments: 2

Patch Set 3 : Allow length-0 extensions. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+36 lines, -2 lines) Patch
M webrtc/p2p/base/stun.cc View 1 2 2 chunks +3 lines, -2 lines 0 comments Download
M webrtc/p2p/base/stun_unittest.cc View 1 2 chunks +33 lines, -0 lines 0 comments Download

Messages

Total messages: 13 (4 generated)
katrielc1
I think this isn't hit in the current code path since this particular brand of ...
4 years, 6 months ago (2016-06-16 14:15:41 UTC) #2
Sergey Ulanov
https://codereview.webrtc.org/2071873002/diff/1/webrtc/p2p/base/stun.cc File webrtc/p2p/base/stun.cc (right): https://codereview.webrtc.org/2071873002/diff/1/webrtc/p2p/base/stun.cc#newcode152 webrtc/p2p/base/stun.cc:152: attr_length = rtc::GetBE16(&data[current_pos + sizeof(attr_type)]); I think here we ...
4 years, 6 months ago (2016-06-17 00:52:49 UTC) #3
Sergey Ulanov
Also, please add unittests
4 years, 6 months ago (2016-06-17 00:53:41 UTC) #4
katrielc1
https://codereview.webrtc.org/2071873002/diff/1/webrtc/p2p/base/stun.cc File webrtc/p2p/base/stun.cc (right): https://codereview.webrtc.org/2071873002/diff/1/webrtc/p2p/base/stun.cc#newcode152 webrtc/p2p/base/stun.cc:152: attr_length = rtc::GetBE16(&data[current_pos + sizeof(attr_type)]); On 2016/06/17 00:52:49, Sergey ...
4 years, 6 months ago (2016-06-17 08:21:55 UTC) #5
Sergey Ulanov
lgtm https://codereview.chromium.org/2071873002/diff/20001/webrtc/p2p/base/stun.cc File webrtc/p2p/base/stun.cc (right): https://codereview.chromium.org/2071873002/diff/20001/webrtc/p2p/base/stun.cc#newcode148 webrtc/p2p/base/stun.cc:148: while (current_pos + 4 < size) { I ...
4 years, 6 months ago (2016-06-18 00:25:54 UTC) #6
katrielc
https://codereview.webrtc.org/2071873002/diff/20001/webrtc/p2p/base/stun.cc File webrtc/p2p/base/stun.cc (right): https://codereview.webrtc.org/2071873002/diff/20001/webrtc/p2p/base/stun.cc#newcode148 webrtc/p2p/base/stun.cc:148: while (current_pos + 4 < size) { On 2016/06/18 ...
4 years, 6 months ago (2016-06-20 11:23:57 UTC) #7
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/2071873002/40001
4 years, 6 months ago (2016-06-20 11:24:19 UTC) #10
commit-bot: I haz the power
Committed patchset #3 (id:40001)
4 years, 6 months ago (2016-06-20 12:13:20 UTC) #11
commit-bot: I haz the power
4 years, 6 months ago (2016-06-20 12:13:31 UTC) #13
Message was sent while issue was closed.
Patchset 3 (id:??) landed as
https://crrev.com/1a2061076412a08f3e4da04a2b33c3795e30b954
Cr-Commit-Position: refs/heads/master@{#13215}

Powered by Google App Engine
This is Rietveld 408576698