Add bounds check to Answer generation

sprintf -> snprintf

Author: juberti

src/main.h

@@ -9,7 +9,7 @@ void lk_websocket(const char *url, const char *token);
 void lk_wifi(void);
 void lk_init_audio_capture(void);
 void lk_init_audio_decoder(void);
-void lk_populate_answer(char *answer, int include_audio);
+void lk_populate_answer(char *answer, size_t answer_size, int include_audio);
 void lk_publisher_peer_connection_task(void *user_data);
 void lk_subscriber_peer_connection_task(void *user_data);
 void lk_audio_encoder_task(void *arg);

src/webrtc.cpp

@@ -212,7 +212,7 @@ PeerConnection *lk_create_peer_connection(int isPublisher) {
   return peer_connection;
 }
 
-static const char *sdp_no_audio =
+static const char sdp_no_audio[] =
     "v=0\r\n"
     "o=- 8611954123959290783 2 IN IP4 127.0.0.1\r\n"
     "s=-\r\n"
@@ -228,7 +228,7 @@ static const char *sdp_no_audio =
     "%s\r\n"  // a=fingeprint
     "a=sctp-port:5000\r\n";
 
-static const char *sdp_audio =
+static const char sdp_audio[] =
     "v=0\r\n"
     "o=- 8611954123959290783 2 IN IP4 127.0.0.1\r\n"
     "s=-\r\n"
@@ -254,14 +254,18 @@ static const char *sdp_audio =
     "%s\r\n"  // a=fingeprint
     "a=recvonly\r\n";
 
-void lk_populate_answer(char *answer, int include_audio) {
+void lk_populate_answer(char *answer, size_t answer_size, int include_audio) {
+  size_t ret = 0;
   if (include_audio) {
-    sprintf(answer, sdp_audio, subscriber_answer_ice_ufrag,
-            subscriber_answer_ice_pwd, subscriber_answer_fingerprint,
-            subscriber_answer_ice_ufrag, subscriber_answer_ice_pwd,
-            subscriber_answer_fingerprint);
+    ret = snprintf(answer, answer_size, sdp_audio, subscriber_answer_ice_ufrag,
+                   subscriber_answer_ice_pwd, subscriber_answer_fingerprint,
+                   subscriber_answer_ice_ufrag, subscriber_answer_ice_pwd,
+                   subscriber_answer_fingerprint);
   } else {
-    sprintf(answer, sdp_no_audio, subscriber_answer_ice_ufrag,
-            subscriber_answer_ice_pwd, subscriber_answer_fingerprint);
+    ret =
+        snprintf(answer, answer_size, sdp_no_audio, subscriber_answer_ice_ufrag,
+                 subscriber_answer_ice_pwd, subscriber_answer_fingerprint);
   }
+
+  assert(ret < answer_size);
 }

src/websocket.cpp

@@ -131,11 +131,12 @@ void lk_websocket_handle_livekit_response(Livekit__SignalResponse *packet) {
                candidate_obj->valuestring);
       if (xSemaphoreTake(g_mutex, portMAX_DELAY) == pdTRUE) {
         if (ice_candidate_buffer != NULL) {
-          xSemaphoreGive(g_mutex);
-          return;
+          ESP_LOGI(LOG_TAG, "ice_candidate_buffer is not NULL");
+        } else {
+          ESP_LOGI(LOG_TAG, "buffering ICE candidate");
+          ice_candidate_buffer = strdup(candidate_obj->valuestring);
         }
 
-        ice_candidate_buffer = strdup(candidate_obj->valuestring);
         xSemaphoreGive(g_mutex);
       }
 
@@ -354,7 +355,8 @@ void lk_websocket(const char *room_url, const char *token) {
         Livekit__SignalRequest r = LIVEKIT__SIGNAL_REQUEST__INIT;
         Livekit__SessionDescription s = LIVEKIT__SESSION_DESCRIPTION__INIT;
 
-        lk_populate_answer(answer_buffer, subscriber_status == 2);
+        lk_populate_answer(answer_buffer, ANSWER_BUFFER_SIZE,
+                           subscriber_status == 2);
         s.sdp = answer_buffer;
         s.type = (char *)SDP_TYPE_ANSWER;
         r.answer = &s;