alhuda c8866bdf9f clamp software copy length in handle_old_stun_command (#2050) ...

Repro: build so `TURN_SOFTWARE` is longer than 120 bytes (e.g. a long
`-DTURN_SERVER_BUILD_INFO`), run with `--rfc3489-compatibility` and
`--software-attribute`, then send a legacy RFC 3489 Binding request.
ASan reports a `stack-buffer-overflow` WRITE at the `memcpy` in
`handle_old_stun_command`.
Cause: the SERVER/SOFTWARE string is copied into `uint8_t software[120]`
via `memcpy(software, get_version(server), oldsz)`. The neighbouring `if
(newsz > sizeof(software))` clamp bounds `newsz` (the attribute length)
but never `oldsz`, so the copy length stays uncapped. Both old-STUN
response sites carry it.
Fix: bound the copy to `min(oldsz, sizeof(software))`. `oldsz` can be
shorter than the rounded-up `newsz`, so copying `newsz` would over-read
the source; the buffer is zero-initialised so the trailing pad bytes
stay zero.

2026-08-09 22:35:11 -07:00

..

apps

fix: shrink oversized stack frames in the test utilities (#2051)

2026-08-09 22:25:44 -07:00

client

Merge commit from fork

2026-07-26 23:04:31 -07:00

client++

Add --stateless-nonce: bound memory under valid-structure STUN floods (#1999) (#2002)

2026-07-25 16:16:01 -07:00

prometheus

Fix realm quota data race and warnings (#1958)

2026-06-21 12:01:11 -07:00

server

clamp software copy length in handle_old_stun_command (#2050)

2026-08-09 22:35:11 -07:00

CMakeLists.txt

Add spdx tags to all source files (#1510)

2025-05-30 11:56:04 +02:00

ns_turn_atomic.h

Add per-source rate-limiting of UDP 401 Unauthorized responses (#1957)

2026-06-21 14:25:09 -07:00

ns_turn_defs.h

Update version to 4.17.2

2026-08-08 14:56:48 -07:00