hitoshura25/cvefixes huggingface dataset:
CVE-2020-15260 (C, published 2021-03-10T23:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjsip/include/pjsip/sip_dialog.h
pjsip/src/pjsip/sip_dialog.c
pjsip/src/pjsip/sip_transport.c
pjsip/src/pjsip/sip_util.c
Commit message: Merge pull request from GHSA-8hcp-hm38-mfph

* Check hostname during TLS transport selection

* revision based on feedback

* remove the code in create_request that has been moved

Vulnerable code:
	pj_strdup(tdata->pool, &tdata->dest_info.name, &dest_info.addr.host);
	pj_strdup(tdata->pool, &tdata->dest_info.name, 
		  &res_addr->dst_host.addr.host);

Fixed code:
    pj_str_t		initial_dest;/**< Initial destination host.  	    */
    
    /* Save initial destination host from transport's info */
    pj_strdup(dlg->pool, &dlg->initial_dest,
    	      &rdata->tp_info.transport->remote_name.host);
    /* Copy the initial destination host to tdata. This information can be
     * used later by transport for transport selection.
     */
    if (dlg->initial_dest.slen)
    	pj_strdup(tdata->pool, &tdata->dest_info.name, &dlg->initial_dest);

    	/* Save initial destination host from transport's info. */
    	if (!dlg->initial_dest.slen) {
    	    pj_strdup(dlg->pool, &dlg->initial_dest,
    	      	      &rdata->tp_info.transport->remote_name.host);
    	}
			if ((type & PJSIP_TRANSPORT_SECURE) && tdata) {
			    /* For secure transport, make sure tdata's
			     * destination host matches the transport's
			     * remote host.
			     */
			    if (pj_stricmp(&tdata->dest_info.name,
				  	   &tp_iter->tp->remote_name.host))
			    {
			    	tp_iter = tp_iter->next;
			    	continue;
			    }
			}

	if (!tdata->dest_info.name.slen) {
	    pj_strdup(tdata->pool, &tdata->dest_info.name,
	    	      &dest_info.addr.host);
	}
	if (!tdata->dest_info.name.slen) {
	    pj_strdup(tdata->pool, &tdata->dest_info.name, 
		      &res_addr->dst_host.addr.host);
	}
CVE-2021-21375 (C, published 2021-03-10T23:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/sdp_neg.c
Commit message: Merge pull request from GHSA-hvq6-f89p-frvp



Vulnerable code:
    char media_used[PJMEDIA_MAX_SDP_MEDIA];
    pj_bzero(media_used, sizeof(media_used));

Fixed code:
    /* When there is no active local SDP in state PJMEDIA_SDP_NEG_STATE_DONE,
     * it means that the previous initial SDP nego must have been failed,
     * so we'll just set the local SDP offer here.
     */
    if (!neg->active_local_sdp) {
	neg->initial_sdp_tmp = NULL;
	neg->initial_sdp = pjmedia_sdp_session_clone(pool, local);
	neg->neg_local_sdp = pjmedia_sdp_session_clone(pool, local);

	return PJ_SUCCESS;
    }
CVE-2021-37706 (C, published 2021-12-22T18:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjnath/src/pjnath/stun_msg.c
Commit message: Merge pull request from GHSA-2qpg-f6wf-w984



Vulnerable code:

Fixed code:
    /* Make sure the length is never negative */
    if (value.slen < 0)
    	value.slen = 0;
CVE-2021-41141 (C, published 2022-01-04T19:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function returns without releasing the currently held locks. This could result in a system deadlock, which cause a denial of service for the users. No release has yet been made which contains the linked fix commit. All versions up to an including 2.11.1 are affected. Users may need to manually apply the patch.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-667 \u2014 Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia-codec/and_aud_mediacodec.cpp
pjmedia/src/pjmedia-codec/ipp_codecs.c
pjmedia/src/pjmedia-codec/opus.c
pjmedia/src/pjmedia-codec/passthrough.c
pjmedia/src/pjmedia-codec/speex_codec.c
pjmedia/src/pjmedia/vid_conf.c
Commit message: Merge pull request from GHSA-8fmx-hqw7-6gmc



Vulnerable code:
    PJ_ASSERT_RETURN(cport->listener_slots, PJ_ENOMEM);
					      sizeof(unsigned));
    PJ_ASSERT_RETURN(cport->transmitter_slots, PJ_ENOMEM);
    PJ_ASSERT_RETURN(cport->render_states, PJ_ENOMEM);
					sizeof(pj_pool_t*));
    PJ_ASSERT_RETURN(cport->render_pool, PJ_ENOMEM);

Fixed code:
	pj_mutex_unlock(and_media_factory.mutex);
	pj_mutex_unlock(ipp_factory.mutex);
	pj_mutex_unlock (opus_data->mutex);
	pj_mutex_unlock (opus_data->mutex);
	pj_mutex_unlock(codec_factory.mutex);
	pj_mutex_unlock(spx_factory.mutex);
	    pj_mutex_unlock(vid_conf->mutex);
	    pj_mutex_unlock(vid_conf->mutex);
    if (!cport->listener_slots) {	
	pj_mutex_unlock(vid_conf->mutex);
	return PJ_ENOMEM;
    }
					      sizeof(unsigned));    
    if (!cport->transmitter_slots) {
	pj_mutex_unlock(vid_conf->mutex);
	return PJ_ENOMEM;
    }

    if (!cport->render_states) {
	pj_mutex_unlock(vid_conf->mutex);
	return PJ_ENOMEM;
    }
					sizeof(pj_pool_t*));    
    if (!cport->render_pool) {
	pj_mutex_unlock(vid_conf->mutex);
	return PJ_ENOMEM;
    }
	    pj_mutex_unlock(vid_conf->mutex);
		pj_mutex_unlock(vid_conf->mutex);
		pj_mutex_unlock(vid_conf->mutex);
CVE-2021-43804 (C, published 2021-12-22T18:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/rtcp.c
Commit message: Merge pull request from GHSA-3qx3-cg72-wrh9



Vulnerable code:

Fixed code:
    	/* Make sure the BYE reason does not exceed:
    	 * - the size of the available buffer
    	 * - the declared reason's length
    	 * - the actual packet size
    	 */
        reason.slen = PJ_MIN(reason.slen, size-9);
CVE-2021-43845 (C, published 2021-12-27T18:15Z)
Description: value: PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/rtcp_xr.c
Commit message: Merge pull request from GHSA-r374-qrwv-86hh



Vulnerable code:
		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr;
		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr;
		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr;
		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr;

Fixed code:
		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <=
			(char*)pkt + size) 
		    {
			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <=
			(char*)pkt + size)
		    {
			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_stats) <=
			(char*)pkt + size)
		    {
			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <=
			(char*)pkt + size)
		    {
			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr;
		    }
CVE-2022-21722 (C, published 2022-01-27T00:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/rtcp.c
pjmedia/src/pjmedia/rtcp_fb.c
pjmedia/src/pjmedia/rtp.c
Commit message: Merge pull request from GHSA-m66q-q64c-hv36

* Prevent OOB read during RTP/RTCP parsing

* Add log

* Add more logs

Vulnerable code:
	pjmedia_rtcp_common *common = (pjmedia_rtcp_common*)p;
	if (p + len > p_end)
    cnt = pj_ntohs((pj_uint16_t)hdr->length) - 2;
    PJ_ASSERT_RETURN(length >= 12, PJ_ETOOSMALL);

Fixed code:
        if (sizeof (pjmedia_rtcp_common) + sizeof (pjmedia_rtcp_sr) > size) {
	    TRACE_((sess->name, "Discarding RTCP SR due to truncated size "
	    			"%d bytes", size));
            return;
        }
	if (sizeof (pjmedia_rtcp_common) + sizeof (pjmedia_rtcp_rr) > size) {
	    TRACE_((sess->name, "Discarding RTCP RR due to truncated size "
	    			"%d bytes", size));
	    return;
	}
	pjmedia_rtcp_common *common;
	if (p + sizeof(pjmedia_rtcp_common) > p_end) {
	    TRACE_((sess->name, "Receiving truncated RTCP packet (1)"));
	    break;
	}
	common = (pjmedia_rtcp_common*)p;

	if (p + len > p_end) {
	    TRACE_((sess->name, "Receiving truncated RTCP packet (2)"));
	}
    cnt = pj_ntohs((pj_uint16_t)hdr->length);
    if (cnt > 2) cnt -= 2; else cnt = 0;

    if (length < 12)
    	return PJ_ETOOSMALL;
        if (offset + sizeof (pjmedia_rtp_ext_hdr) > pkt_len)
            return PJMEDIA_RTP_EINLEN;
CVE-2022-21723 (C, published 2022-01-27T00:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/scanner.c
Commit message: Merge pull request from GHSA-7fw8-54cv-r7pm



Vulnerable code:
    int chr = *scanner->curptr;
    if (!chr) {
    ++scanner->curptr;
    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {

Fixed code:
    register char *s = scanner->curptr;
    int chr;
    if (s >= scanner->end || !*s) {
    chr = *s;
    ++s;
    scanner->curptr = s;
    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
    	scanner->skip_ws)
    {
CVE-2022-23537 (C, published 2022-12-20T19:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/pjsip/pjproject
Files changed:
pjnath/include/pjnath/stun_msg.h
pjnath/src/pjnath/stun_msg.c
Commit message: Merge pull request from GHSA-9pfh-r8x4-w26w

* Fix buffer overread in STUN message decoder

* Updates based on comments

Vulnerable code:
#define ATTR_HDR_LEN        4
    while (pdu_len >= 4) {
        if (pdu_len < attr_val_len) {

Fixed code:
#pragma pack(1)
#pragma pack()
#pragma pack(1)
#pragma pack()
#define ATTR_HDR_LEN        sizeof(pj_stun_attr_hdr)
    } else {
        /* For safety, verify packet length at least */
        pj_uint32_t msg_len = GETVAL16H(pdu, 2) + 20;
        if (msg_len > pdu_len ||
            ((options & PJ_STUN_IS_DATAGRAM) && msg_len != pdu_len))
        {
            return PJNATH_EINSTUNMSGLEN;
        }
    while (pdu_len >= ATTR_HDR_LEN) {
        if (pdu_len < attr_val_len + ATTR_HDR_LEN) {
CVE-2022-23547 (C, published 2022-12-23T15:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/pjsip/pjproject
Files changed:
pjnath/src/pjnath/stun_msg.c
Commit message: Merge pull request from GHSA-cxwq-5g9x-x7fr

* Fixed heap buffer overflow when parsing STUN errcode attribute

* Also fixed uint parsing

Vulnerable code:
    attr->value = GETVAL32H(buf, 4);

    /* Make sure the length is never negative */
    if (value.slen < 0)
        value.slen = 0;

Fixed code:
    attr->value = GETVAL32H(buf, 4);

    /* Check that the attribute length is valid */
    if (attr->hdr.length < 4)
        return PJNATH_ESTUNINATTRLEN;
CVE-2022-24763 (C, published 2022-03-30T21:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/xml.c
Commit message: Merge pull request from GHSA-5x45-qp78-g4p4

* Prevent infinite loop in scanning xml content

* Simplify scanning method

* Optimization

Vulnerable code:

Fixed code:

	    pj_scan_advance_n(scanner, 1, PJ_FALSE);
CVE-2022-24764 (C, published 2022-03-22T17:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/sdp.c
Commit message: Merge pull request from GHSA-f5qg-pqcg-765m



Vulnerable code:
	*p++ = ' ';
	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	p += m->desc.fmt[i].slen;
    *p++ = '\r';
    *p++ = '\n';

Fixed code:
	if (end-p > m->desc.fmt[i].slen) {
	    *p++ = ' ';
	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	    p += m->desc.fmt[i].slen;
	} else {
	    return -1;
	}
    }

    if (end-p >= 2) {
	*p++ = '\r';
	*p++ = '\n';
    } else {
	return -1;
CVE-2022-24764 (C, published 2022-03-22T17:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/pjsip/pjproject
Files changed:
pjmedia/src/pjmedia/sdp.c
Commit message: Merge pull request from GHSA-f5qg-pqcg-765m



Vulnerable code:
	*p++ = ' ';
	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	p += m->desc.fmt[i].slen;
    *p++ = '\r';
    *p++ = '\n';

Fixed code:
	if (end-p > m->desc.fmt[i].slen) {
	    *p++ = ' ';
	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	    p += m->desc.fmt[i].slen;
	} else {
	    return -1;
	}
    }

    if (end-p >= 2) {
	*p++ = '\r';
	*p++ = '\n';
    } else {
	return -1;
CVE-2022-24793 (C, published 2022-04-06T14:15Z)
Description: value: PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/pjsip/pjproject
Files changed:
pjlib-util/src/pjlib-util/dns.c
Commit message: Merge pull request from GHSA-p6g5-v97c-w5q4

* Prevent heap buffer overflow when parsing DNS packets

* Make sure packet parsing doesn't advance beyond max/end

* Update checks

* Remove  check

Co-authored-by: sauwming <ming@teluu.com>

Vulnerable code:
	    /* Check that label length is valid */
	    if (pkt+label_len > max)

	    if (p >= max)
		return PJLIB_UTIL_EDNSINSIZE;
	    /* Check that label length is valid */
	    if (pkt+label_len > max)

	    if (p >= max)
		return PJLIB_UTIL_EDNSINSIZE;

Fixed code:
	    /* Check that label length is valid.
	     * Each label consists of an octet length (of size 1) followed
	     * by the octet of the specified length (label_len). Then it
	     * must be followed by either another label's octet length or
	     * a zero length octet (that terminates the sequence).
	     */
	    if (p+1+label_len+1 > max)
	    /* Check that label length is valid.
	     * Each label consists of an octet length (of size 1) followed
	     * by the octet of the specified length (label_len). Then it
	     * must be followed by either another label's octet length or
	     * a zero length octet (that terminates the sequence).
	     */
	    if (p+1+label_len+1 > max)
    /* Check the size can accomodate next few fields. */
    if (p + 4 > max)
    	return PJLIB_UTIL_EDNSINSIZE;