[sr-dev] git:3.3: parser: safety check for max port length in URI

Module: sip-router Branch: 3.3 Commit: 0e9eafc25ca3240f690469116cee8ff3708eeee7 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=0e9eafc… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Henning Westerholt &lt;hw(a)kamailio.org&gt; Date: Tue Apr 9 00:18:35 2013 +0200 parser: safety check for max port length in URI - can't be longer than 5, a port being 16b value - reported by Kevin Wojtysiak (cherry picked from commit 13fd48f89555f5421e8285669e303bcefe44f149) --- parser/parse_uri.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/parser/parse_uri.c b/parser/parse_uri.c index a244cf2..b875827 100644 --- a/parser/parse_uri.c +++ b/parser/parse_uri.c @@ -1207,6 +1207,10 @@ int parse_uri(char* buf, int len, struct sip_uri* uri) goto error_bad_uri; break; /* do nothing, avoids a compilation warning */ } + + if(uri->port.len>5) + goto error_invalid_port; + #ifdef EXTRA_DEBUG /* do stuff */ DBG("parsed uri:\n type=%d user=<%.*s>(%d)\n passwd=<%.*s>(%d)\n" @@ -1270,6 +1274,10 @@ error_bad_port: *p, state, (int)(p-buf), ZSW(buf), (int)(p-buf), len, ZSW(buf), len); goto error_exit; +error_invalid_port: + DBG("parse_uri: bad port in uri: [%.*s] in <%.*s>\n", + uri->port.len, uri->port.s, len, ZSW(buf)); + goto error_exit; error_bad_uri: DBG("parse_uri: bad uri, state %d" " parsed: <%.*s> (%d) / <%.*s> (%d)\n",