On Thu, Mar 11, 2010 at 9:16 AM, Doug Porter <span dir="ltr"><<a href="mailto:dsp@exacq.com">dsp@exacq.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">Jeremy Noring <<a href="mailto:jnoring@logitech.com">jnoring@logitech.com</a>> writes:<br>
><br>
> Actually, on second glance, the only realistic option is to<br>
> shorten length, because only a single byte is allotted to the<br>
> size field in fData[1]. (note that length is cast to unsigned<br>
> char). So in RTCP.cpp, I'd change this line:<br>
><br>
> if (length > 251) length = 251;<br>
<br>
</div>The text of an SDES item can be up to 255 octets (IETF RFC 3550<br>
section 6.5).<font color="#888888"><a href="http://lists.live555.com/mailman/listinfo/live-devel" target="_blank"></a></font></blockquote><div><br>Yeah, I realized that. I also see this code is never called with a buffer longer than 100 bytes, so it will never overflow. But I'd still fix it, just in case.<br>
<br>I'd go with:<br><br> // first 2 bytes are tag and length, then actual data (max length of 255),<br> // then at least one byte for null terminator<br> unsigned char fData[2 + 255 + 1];<br><br>...<br><br>SDESItem::SDESItem(unsigned char tag, unsigned char const* value) {<br>
unsigned length = strlen((char const*)value);<br> if (length > 255) length = 255;<br><br> fData[0] = tag;<br> fData[1] = (unsigned char)length;<br> memcpy(&fData[2], value, length);<br> fData[2 + length] = '\0';<br>
}<br></div></div><br>