[sr-dev] git:master: nathelper(k): fix for very long payload-type

[Daniel-Constantin Mierla]

Module: sip-router
Branch: master
Commit: 8c97cfc35fcaf17f67810f98725bb636601bb38b
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=8c97cfc35fcaf17f67810f98725bb636601bb38b

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date:   Thu Jul  2 11:47:29 2009 +0200

nathelper(k): fix for very long payload-type

- fix SF: #2813924: publishing very long payload-type to the rtp-proxy
  overflows a buffer
- patch by Marcus Hunger

---

 modules_k/nathelper/nathelper.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/modules_k/nathelper/nathelper.c b/modules_k/nathelper/nathelper.c
index 01ae520..8c71ef9 100644
--- a/modules_k/nathelper/nathelper.c
+++ b/modules_k/nathelper/nathelper.c
@@ -2779,7 +2779,9 @@ force_rtp_proxy(struct sip_msg* msg, char* str1, char* str2, int offer)
 					 * a comma-separated list.
 					 */
 					for (cp = payload_types.s;
-					    cp < payload_types.s + payload_types.len; cp++) {
+							(cp < payload_types.s + payload_types.len) &&
+							(cp1 - (char *)v[1].iov_base < sizeof(opts) - 1);
+							cp++) {
 						if (isdigit(*cp)) {
 							*cp1 = *cp;
 							cp1++;