Bug 923468 - Safety patch for race condition. r=ekr
authorAdrian Cruceru <cruceru.adrian@yahoo.com>
Mon, 06 Jan 2014 12:40:03 -0500
changeset 162197 d2407baebc53b3019c34e5c086d4d9b5d3df0924
parent 162196 658e342f400cb53ca561536e52fcad7ff7a7f6a7
child 162198 f772c534bcafc59998250bf16eec64e8364f1f83
push idunknown
push userunknown
push dateunknown
reviewersekr
bugs923468
milestone29.0a1
Bug 923468 - Safety patch for race condition. r=ekr
media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
--- a/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
+++ b/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
@@ -187,16 +187,18 @@ int nr_ice_media_stream_get_attributes(n
       if (comp->state != NR_ICE_COMPONENT_DISABLED) {
         nr_ice_candidate *cand;
 
         cand=TAILQ_FIRST(&comp->candidates);
         while(cand){
           if (cand->state == NR_ICE_CAND_STATE_INITIALIZED) {
             assert(index < attrct);
 
+            if (index >= attrct)
+              ABORT(R_INTERNAL);
 
             if(r=nr_ice_format_candidate_attribute(cand, attrs[index],NR_ICE_MAX_ATTRIBUTE_SIZE))
               ABORT(r);
 
             index++;
           }
 
           cand=TAILQ_NEXT(cand,entry_comp);