Fix buffer overflow in HMAC validation of STUN messages.

webrtc/p2p/base/stun.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 127 matching lines @@
 
   // Getting the message length from the STUN header.
   uint16_t msg_length = rtc::GetBE16(&data[2]);
   if (size != (msg_length + kStunHeaderSize)) {
     return false;
   }
 
   // Finding Message Integrity attribute in stun message.
   size_t current_pos = kStunHeaderSize;
   bool has_message_integrity_attr = false;
-  while (current_pos < size) {
+  while (current_pos + 4 <= size) {
     uint16_t attr_type, attr_length;
     // Getting attribute type and length.
     attr_type = rtc::GetBE16(&data[current_pos]);
     attr_length = rtc::GetBE16(&data[current_pos + sizeof(attr_type)]);
 
     // If M-I, sanity check it, and break out.
     if (attr_type == STUN_ATTR_MESSAGE_INTEGRITY) {
       if (attr_length != kStunMessageIntegritySize ||
-          current_pos + attr_length > size) {
+          current_pos + sizeof(attr_type) + sizeof(attr_length) + attr_length >
+              size) {
         return false;
       }
       has_message_integrity_attr = true;
       break;
     }
 
     // Otherwise, skip to the next attribute.
     current_pos += sizeof(attr_type) + sizeof(attr_length) + attr_length;
     if ((attr_length % 4) != 0) {
       current_pos += (4 - (attr_length % 4));
@@ skipping 743 matching lines @@
       digest, sizeof(digest));
   if (size == 0) {
     return false;
   }
 
   *hash = std::string(digest, size);
   return true;
 }
 
 }  // namespace cricket