January 18, 2004

Vulnerabilities and how to use PWLib with other libraries

I thought I was going to be able to spend my time at the Open Source and Telephony conference in Germany finishing off the audio codec plugins. No such luck - the NISCC and CERT chose the day before I left to announce the release of a toolkit that demonstrates buffer overflow problems in a variety of H.323 stacks, including OpenH323.

So I have spent the time running their code and fixing the problems. Of the nearly 4500 tests in the suite, OpenH323 failed two of them, which took three lines of code to fix. These pointed out several other potential problems as well, so the total changes were about 20 lines. I've just this minute finished releasing new version of PWLib (1.6.0) and OpenH323 (1.13.0) that contain these fixes.

It was mentioned to me at the conference that a problem with PWLib was that it could not be combined with other C++ libraries in a single program due to the requirement that the PProcess object needs to be declared and it takes over the "main" function. However, this is not true - it is remarkably easy to combine OpenH323 with other libraries such as MFC or Qt by simply instantiating a PProcess descendant inside the "main" function or the application class. I have done this many times for customers, and it works very well.

We have even provided an example of to do this inside "openh323/samples/mfc" project. This is a Windows MFC program created by the MSVC application Wizard that declares a PProcess instance inside the CMfcApp class as follows:

class PWLibProcess : public PProcess {
PCLASSINFO(PWLibProcess, PProcess);
void Main() { }
} pwlibProcess;

While this looks a little odd, it is merely a very abbreviated way to declare an decendant of PProcess called PWLibProcess, to override the Main virtual function with an empty body, and then instantiate this into a member variable called pwlibProcess. Once this is done, PWLib and OpenH323 functions can be used as normal within MFC classes, subject to to normal rules.

Posted by CraigS at January 18, 2004 07:17 AM
Posted to OpenH323

Comments