Module: sip-router Branch: kamailio_3.0 Commit: 4ef016026292c71d0ad731a8895c6b89efe1c769 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=4ef0160… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Mon Nov 30 12:29:20 2009 +0100 presence(k): fix off-by-one memory allocation Due to some missing '()' ( (...)?resource.len:event.len + 1 instead of ((...)?resource.len:event.len) + 1 ) sometimes the memory allocated was less with one byte then what was needed. The fixed version also replaces ?: with MAX_unsigned() (does the same thing and it's easier to read). Reported-by: Andres Moya andres.moya.i gmail com (cherry picked from commit 229bd1f517cb9177dc731929c31153b2b9513215) --- modules_k/presence/notify.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/modules_k/presence/notify.c b/modules_k/presence/notify.c index 92c2f55..6d16033 100644 --- a/modules_k/presence/notify.c +++ b/modules_k/presence/notify.c @@ -1793,8 +1793,7 @@ str* create_winfo_xml(watcher_t* watchers, char* version, LM_ERR("while adding child\n"); goto error; } - res= (char*)pkg_malloc((resource.len>event.len)?resource.len:event.len - + 1); + res= (char*)pkg_malloc(MAX_unsigned(resource.len, event.len) + 1); if(res== NULL) { ERR_MEM(PKG_MEM_STR);