Module: sip-router
Branch: master
Commit: 745e30c92336bfc3f8682b2c23e02862db688d9e
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=745e30c…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Oct 1 11:55:16 2012 +0200
tcp: fix _wbufq_insert bug
When _wbufq_insert was called on a connection that had already
some data added to the write buffer (another process was faster
and added some data before the process that created the connection
had a chance to do it), a wrong size was used in a memmove.
This could lead either to corrupted messages or even crashes (if
the messages were big enough to cause a buffer overflow).
Many thanks to Jijo for debugging it.
Reported-by: Jijo
---
tcp_main.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/tcp_main.c b/tcp_main.c
index e17d06a..2c4bf82 100644
--- a/tcp_main.c
+++ b/tcp_main.c
@@ -808,7 +808,7 @@ inline static int _wbufq_insert(struct tcp_connection* c, const char* data,
}
if ((q->first==q->last) && ((q->last->b_size-q->last_used)>=size)){
/* one block with enough space in it for size bytes */
- memmove(q->first->buf+size, q->first->buf, size);
+ memmove(q->first->buf+size, q->first->buf, q->last_used);
memcpy(q->first->buf, data, size);
q->last_used+=size;
}else{
