git:master:e0e08846: topos_htable: fix xtag and add more snprintf checks - sr-dev

21 Feb 2025

Module: kamailio
Branch: master
Commit: e0e0884627609804661082a1235f87a7bbb5e67a
URL: https://github.com/kamailio/kamailio/commit/e0e0884627609804661082a1235f87a7...
Author: Stefan Mititelu stefan.mititelu@net2phone.com
Committer: Daniel-Constantin Mierla miconda@gmail.com
Date: 2025-02-21T08:47:15+01:00
topos_htable: fix xtag and add more snprintf checks
---
Modified: src/modules/topos_htable/topos_htable_storage.c
---
Diff:  https://github.com/kamailio/kamailio/commit/e0e0884627609804661082a1235f87a7...
Patch: https://github.com/kamailio/kamailio/commit/e0e0884627609804661082a1235f87a7...
---

diff --git a/src/modules/topos_htable/topos_htable_storage.c b/src/modules/topos_htable/topos_htable_storage.c
index 043652e5280..eec48ce7641 100644
--- a/src/modules/topos_htable/topos_htable_storage.c
+++ b/src/modules/topos_htable/topos_htable_storage.c
@@ -185,7 +185,7 @@ static int tps_htable_insert_initial_method_branch(
    }
if(ret < 0 || ret >= TPS_HTABLE_SIZE_VAL) {
-		LM_ERR("failed to build htable value\n");
+		LM_ERR("failed to build htable val\n");
    	return -1;
    }
@@ -758,7 +758,7 @@ static int tps_htable_insert_dialog_helper(tps_data_t *td, int set_expire)
    			  td->a_uuid.len, td->a_uuid.s)
    						   : snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%.*s",
    								   td->b_uuid.len, td->b_uuid.s);
-	if(ret < 0) {
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
    	LM_ERR("failed to build htable key\n");
    	return -1;
    }
@@ -771,6 +771,11 @@ static int tps_htable_insert_dialog_helper(tps_data_t *td, int set_expire)
    	ret = snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%s", _tps_base64_buf[0]);
    }
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
+		LM_ERR("failed to build htable key\n");
+		return -1;
+	}
+
// build val
    rectime = (unsigned long)time(NULL);
@@ -849,7 +854,7 @@ static int tps_htable_insert_dialog_helper(tps_data_t *td, int set_expire)
    			td->x_context.s);
    }
-	if(ret < 0) {
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_VAL) {
    	LM_ERR("failed to build htable val\n");
    	return -1;
    }
@@ -919,7 +924,7 @@ int tps_htable_load_dialog(sip_msg_t *msg, tps_data_t *md, tps_data_t *sd)
    			  md->a_uuid.len, md->a_uuid.s)
    						   : snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%.*s",
    								   md->b_uuid.len, md->b_uuid.s);
-	if(ret < 0) {
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
    	LM_ERR("failed to build htable key\n");
    	return -1;
    }
@@ -931,6 +936,10 @@ int tps_htable_load_dialog(sip_msg_t *msg, tps_data_t *md, tps_data_t *sd)
    			_tps_base64_buf[0], TPS_BASE64_SIZE - 1);
    	ret = snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%s", _tps_base64_buf[0]);
    }
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
+		LM_ERR("failed to build htable key\n");
+		return -1;
+	}
hkey.s = _tps_htable_key_buf;
    hkey.len = strlen(_tps_htable_key_buf);
@@ -1190,7 +1199,7 @@ int tps_htable_end_dialog(sip_msg_t *msg, tps_data_t *md, tps_data_t *sd)
    			  sd->a_uuid.len, sd->a_uuid.s)
    						   : snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%.*s",
    								   sd->b_uuid.len, sd->b_uuid.s);
-	if(ret < 0) {
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
    	LM_ERR("failed to build htable key\n");
    	return -1;
    }
@@ -1202,6 +1211,10 @@ int tps_htable_end_dialog(sip_msg_t *msg, tps_data_t *md, tps_data_t *sd)
    			_tps_base64_buf[0], TPS_BASE64_SIZE - 1);
    	ret = snprintf(ptr, TPS_HTABLE_SIZE_KEY, "%s", _tps_base64_buf[0]);
    }
+	if(ret < 0 || ret >= TPS_HTABLE_SIZE_KEY) {
+		LM_ERR("failed to build htable key\n");
+		return -1;
+	}
// dialog ended -- keep it for branch lifetime only

    