Fixing stack buffer overflow (read) in SctpDataEngine.

webrtc/media/sctp/sctpdataengine.cc

Index: webrtc/media/sctp/sctpdataengine.cc
diff --git a/webrtc/media/sctp/sctpdataengine.cc b/webrtc/media/sctp/sctpdataengine.cc
index 2d8d48eee370fe2f79721261df3ed7e39cdd3b66..04a596bc4133ca467e9928feb19ab3aa25aaf5ec 100644
--- a/webrtc/media/sctp/sctpdataengine.cc
+++ b/webrtc/media/sctp/sctpdataengine.cc
@@ -550,8 +550,8 @@ bool SctpDataMediaChannel::Connect() {
   // Set the MTU and disable MTU discovery.
   // We can only do this after usrsctp_connect or it has no effect.
   sctp_paddrparams params = {{0}};
-  memcpy(reinterpret_cast<sockaddr*>(&params.spp_address),
-         reinterpret_cast<sockaddr*>(&remote_sconn), sizeof(sockaddr));
+  memcpy(reinterpret_cast<sockaddr_conn*>(&params.spp_address), &remote_sconn,

[skvlad, 2016/09/06 18:29:16]

Could this be done as an assignment instead? That would make it just a bit less
likely to use the wrong size.
*reinterpret_cast<sockaddr_conn*>(&params.spp_address) = remote_sconn;

[Taylor Brandstetter, 2016/09/06 20:00:47]

Hmm. It seems like that would work, but I see the memcpy pattern used with
sockaddrs pretty consistently elsewhere in the codebase. Maybe there's a caveat
we're not thinking of.

[honghaiz3, 2016/09/06 22:12:09]

Does it matter to reinterpret_cast the dest pointer?
memcpy takes arguments (void*, void*, size_t). 

[Taylor Brandstetter, 2016/09/06 22:54:29]

Maybe not; again, I was copying the pattern used elsewhere. I'll change this.

+         sizeof(remote_sconn));
   params.spp_flags = SPP_PMTUD_DISABLE;
   params.spp_pathmtu = kSctpMtu;
   if (usrsctp_setsockopt(sock_, IPPROTO_SCTP, SCTP_PEER_ADDR_PARAMS, &params,