Module: kamailio Branch: master Commit: d4a2ba2ef4323b4306109ab5ecccd1368e8c5f82 URL: https://github.com/kamailio/kamailio/commit/d4a2ba2ef4323b4306109ab5ecccd13… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2016-05-09T13:31:28+02:00 smsops: safety checks for pkg malloc in pv get handler --- Modified: modules/smsops/smsops_impl.c --- Diff: https://github.com/kamailio/kamailio/commit/d4a2ba2ef4323b4306109ab5ecccd13… Patch: https://github.com/kamailio/kamailio/commit/d4a2ba2ef4323b4306109ab5ecccd13… --- diff --git a/modules/smsops/smsops_impl.c b/modules/smsops/smsops_impl.c index a772f93..9caf19f 100644 --- a/modules/smsops/smsops_impl.c +++ b/modules/smsops/smsops_impl.c @@ -603,7 +603,7 @@ int pv_get_sms(struct sip_msg *msg, pv_param_t *param, pv_value_t *res) { int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) { if (param==NULL) return -1; - + if (!rp_send_data) { rp_send_data = (sms_rp_data_t*)pkg_malloc(sizeof(struct _sms_rp_data)); if (!rp_send_data) { @@ -655,6 +655,10 @@ int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) return -1; } rp_send_data->originator.s = pkg_malloc(val->rs.len); + if(rp_send_data->originator.s==NULL) { + LM_ERR("no more pkg\n"); + return -1; + } rp_send_data->originator.len = val->rs.len; memcpy(rp_send_data->originator.s, val->rs.s, val->rs.len); break; @@ -671,6 +675,10 @@ int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) return -1; } rp_send_data->destination.s = pkg_malloc(val->rs.len); + if(rp_send_data->destination.s==NULL) { + LM_ERR("no more pkg\n"); + return -1; + } rp_send_data->destination.len = val->rs.len; memcpy(rp_send_data->destination.s, val->rs.s, val->rs.len); break; @@ -754,6 +762,10 @@ int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) return -1; } rp_send_data->pdu.payload.s = pkg_malloc(val->rs.len); + if(rp_send_data->pdu.payload.s==NULL) { + LM_ERR("no more pkg\n"); + return -1; + } rp_send_data->pdu.payload.len = val->rs.len; memcpy(rp_send_data->pdu.payload.s, val->rs.s, val->rs.len); break; @@ -770,6 +782,10 @@ int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) return -1; } rp_send_data->pdu.destination.s = pkg_malloc(val->rs.len); + if(rp_send_data->pdu.destination.s==NULL) { + LM_ERR("no more pkg\n"); + return -1; + } rp_send_data->pdu.destination.len = val->rs.len; memcpy(rp_send_data->pdu.destination.s, val->rs.s, val->rs.len); break; @@ -786,6 +802,10 @@ int pv_set_sms(struct sip_msg* msg, pv_param_t *param, int op, pv_value_t *val) return -1; } rp_send_data->pdu.originating_address.s = pkg_malloc(val->rs.len); + if(rp_send_data->pdu.originating_address.s==NULL) { + LM_ERR("no more pkg\n"); + return -1; + } rp_send_data->pdu.originating_address.len = val->rs.len; memcpy(rp_send_data->pdu.originating_address.s, val->rs.s, val->rs.len); break;