diff --git a/plugins/VOIP/services/rsVOIPItems.cc b/plugins/VOIP/services/rsVOIPItems.cc index afc76b505..9ba20868e 100644 --- a/plugins/VOIP/services/rsVOIPItems.cc +++ b/plugins/VOIP/services/rsVOIPItems.cc @@ -447,6 +447,9 @@ RsVOIPDataItem::RsVOIPDataItem(void *data, uint32_t pktsize) ok &= getRawUInt32(data, rssize, &offset, &flags); ok &= getRawUInt32(data, rssize, &offset, &data_size); + if(data_size > rssize || rssize - data_size < offset) + throw std::runtime_error("Not enough space.") ; + voip_data = malloc(data_size) ; memcpy(voip_data,&((uint8_t*)data)[offset],data_size) ; offset += data_size ;