From 597b36c5a29e74af58f734f2f1ffd550abc1bfe3 Mon Sep 17 00:00:00 2001 From: Gustavo Garcia Date: Wed, 4 Oct 2023 19:06:40 +0200 Subject: [PATCH] Fix missing strncpy in fix_stun_check_message_integrity_str (#1282) Co-authored-by: Gustavo Garcia Co-authored-by: Pavel Punsky --- src/client/ns_turn_msg.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/client/ns_turn_msg.c b/src/client/ns_turn_msg.c index b6a068e..20ae812 100644 --- a/src/client/ns_turn_msg.c +++ b/src/client/ns_turn_msg.c @@ -1967,10 +1967,12 @@ int stun_check_message_integrity_str(turn_credential_type ct, uint8_t *buf, size hmackey_t key; password_t pwd; - if (ct == TURN_CREDENTIALS_SHORT_TERM) - strncpy((char *)pwd, (const char *)upwd, sizeof(password_t)); - else if (stun_produce_integrity_key_str(uname, realm, upwd, key, shatype) < 0) + if (ct == TURN_CREDENTIALS_SHORT_TERM) { + len = strncpy((char *)pwd, (const char *)upwd, sizeof(password_t) - 1); + pwd[sizeof(password_t) - 1] = 0; + } else if (stun_produce_integrity_key_str(uname, realm, upwd, key, shatype) < 0) { return -1; + } return stun_check_message_integrity_by_key_str(ct, buf, len, key, pwd, shatype); }