Fixed out of bounds array access

3dEYE · May 12, 2021 · 5db4be2 · 5db4be2
1 parent 69f56f4
commit 5db4be2
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 8 deletions.
diff --git a/plugins/janus_echotest.c b/plugins/janus_echotest.c
@@ -989,8 +989,10 @@ static void *janus_echotest_handler(void *data) {
 		}
 		if(substream) {
 			session->sim_context.substream_target = json_integer_value(substream);
-			JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
-				session->ssrc[session->sim_context.substream], session->sim_context.substream_target, session->sim_context.substream);
+			if(session->sim_context.substream_target >= 0 && session->sim_context.substream_target <= 2) {
+				JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
+					session->ssrc[session->sim_context.substream_target], session->sim_context.substream_target, session->sim_context.substream);
+			}
 			if(session->sim_context.substream_target == session->sim_context.substream) {
 				/* No need to do anything, we're already getting the right substream, so notify the user */
 				json_t *event = json_object();

diff --git a/plugins/janus_videocall.c b/plugins/janus_videocall.c
@@ -1490,8 +1490,10 @@ static void *janus_videocall_handler(void *data) {
 			}
 			if(substream) {
 				session->sim_context.substream_target = json_integer_value(substream);
-				JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
-					session->ssrc[session->sim_context.substream], session->sim_context.substream_target, session->sim_context.substream);
+				if(session->sim_context.substream_target >= 0 && session->sim_context.substream_target <= 2) {
+					JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
+						session->ssrc[session->sim_context.substream_target], session->sim_context.substream_target, session->sim_context.substream);
+				}
 				if(session->sim_context.substream_target == session->sim_context.substream) {
 					/* No need to do anything, we're already getting the right substream, so notify the user */
 					json_t *event = json_object();

diff --git a/plugins/janus_videoroom.c b/plugins/janus_videoroom.c
@@ -7019,10 +7019,12 @@ static void *janus_videoroom_handler(void *data) {
 					/* Check if a simulcasting-related request is involved */
 					if(sc_substream && (publisher->ssrc[0] != 0 || publisher->rid[0] != NULL)) {
 						subscriber->sim_context.substream_target = json_integer_value(sc_substream);
-						JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
-							publisher->ssrc[subscriber->sim_context.substream],
-							subscriber->sim_context.substream_target,
-							subscriber->sim_context.substream);
+						if(subscriber->sim_context.substream_target >= 0 && subscriber->sim_context.substream_target <= 2) {
+							JANUS_LOG(LOG_VERB, "Setting video SSRC to let through (simulcast): %"SCNu32" (index %d, was %d)\n",
+								publisher->ssrc[subscriber->sim_context.substream_target],
+								subscriber->sim_context.substream_target,
+								subscriber->sim_context.substream);
+						}
 						if(subscriber->sim_context.substream_target == subscriber->sim_context.substream) {
 							/* No need to do anything, we're already getting the right substream, so notify the user */
 							json_t *event = json_object();