Fixing stack buffer overflow (read) in SctpDataEngine.

webrtc/media/sctp/sctpdataengine.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 532 matching lines @@
       sock_, reinterpret_cast<sockaddr *>(&remote_sconn), sizeof(remote_sconn));
   if (connect_result < 0 && errno != SCTP_EINPROGRESS) {
     LOG_ERRNO(LS_ERROR) << debug_name_ << "Failed usrsctp_connect. got errno="
                         << errno << ", but wanted " << SCTP_EINPROGRESS;
     CloseSctpSocket();
     return false;
   }
   // Set the MTU and disable MTU discovery.
   // We can only do this after usrsctp_connect or it has no effect.
   sctp_paddrparams params = {{0}};
-  memcpy(reinterpret_cast<sockaddr*>(&params.spp_address),
-         reinterpret_cast<sockaddr*>(&remote_sconn), sizeof(sockaddr));
+  memcpy(reinterpret_cast<sockaddr_conn*>(&params.spp_address), &remote_sconn,

[skvlad, 2016/09/06 18:29:16]

Could this be done as an assignment instead? That would make it just a bit less
likely to use the wrong size.
*reinterpret_cast<sockaddr_conn*>(&params.spp_address) = remote_sconn;

[Taylor Brandstetter, 2016/09/06 20:00:47]

Hmm. It seems like that would work, but I see the memcpy pattern used with
sockaddrs pretty consistently elsewhere in the codebase. Maybe there's a caveat
we're not thinking of.

[honghaiz3, 2016/09/06 22:12:09]

Does it matter to reinterpret_cast the dest pointer?
memcpy takes arguments (void*, void*, size_t). 

[Taylor Brandstetter, 2016/09/06 22:54:29]

Maybe not; again, I was copying the pattern used elsewhere. I'll change this.

+         sizeof(remote_sconn));
   params.spp_flags = SPP_PMTUD_DISABLE;
   params.spp_pathmtu = kSctpMtu;
   if (usrsctp_setsockopt(sock_, IPPROTO_SCTP, SCTP_PEER_ADDR_PARAMS, &params,
                          sizeof(params))) {
     LOG_ERRNO(LS_ERROR) << debug_name_
                         << "Failed to set SCTP_PEER_ADDR_PARAMS.";
   }
   return true;
 }
 
@@ skipping 493 matching lines @@
     }
     case MSG_SCTPOUTBOUNDPACKET: {
       std::unique_ptr<OutboundPacketMessage> pdata(
           static_cast<OutboundPacketMessage*>(msg->pdata));
       OnPacketFromSctpToNetwork(pdata->data().get());
       break;
     }
   }
 }
 }  // namespace cricket