[sr-dev] git:master: modules/dialog_ng: bug fix for concurrent dialog did generation

[Jason Penton]

Thanks Hugh

long day and a little pain (had one of my teeth removed today ;) ) - have
fixed and also added null termianting string in case someone tries to deref
char*

Cheer
Jason



On Tue, Apr 2, 2013 at 8:17 PM, Hugh Waite <hugh.waite at crocodile-rcs.com>wrote:

> Hi Jason,
> When appending the 'x' to the did, I think len is the wrong index value.
> It should be 'len-1' or 'dlg->did.len'.
> new_did->s[dlg->did.len] = 'x';
>
> Regards,
> Hugh
>
>
> On 02/04/2013 18:46, Jason Penton wrote:
>
>> Module: sip-router
>> Branch: master
>> Commit: 9e7f627c5e9a4c34193e4662fbe341**b70fa308bf
>> URL:    http://git.sip-router.org/cgi-**bin/gitweb.cgi/sip-router/?a=**
>> commit;h=**9e7f627c5e9a4c34193e4662fbe341**b70fa308bf<http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=9e7f627c5e9a4c34193e4662fbe341b70fa308bf>
>>
>> Author: Jason Penton <jason.penton at smilecoms.com>
>> Committer: Jason Penton <jason.penton at smilecoms.com>
>> Date:   Tue Apr  2 19:44:46 2013 +0200
>>
>> modules/dialog_ng: bug fix for concurrent dialog did generation
>>         - spotted by Camille @ Orange - tks!
>>
>> ---
>>
>>   modules/dialog_ng/dlg_hash.c |    7 ++++---
>>   1 files changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/modules/dialog_ng/dlg_hash.c b/modules/dialog_ng/dlg_hash.c
>> index 97e1371..51f8eec 100644
>> --- a/modules/dialog_ng/dlg_hash.c
>> +++ b/modules/dialog_ng/dlg_hash.c
>> @@ -1268,12 +1268,13 @@ int dlg_set_toroute(struct dlg_cell *dlg, str *
>> route) {
>>    */
>>   void create_concurrent_did(struct dlg_cell *dlg, str * new_did) {
>>       int len  = dlg->did.len + 1;
>> -    new_did = shm_malloc(len);
>> -    if (new_did == 0) {
>> +    new_did->s = shm_malloc(len);
>> +    if (new_did->s == 0) {
>>           LM_ERR("no more shm mem (%d)\n", len);
>> +        return;
>>       }
>>       memcpy(new_did->s, dlg->did.s, dlg->did.len);
>> -    new_did->s[dlg->did.len+1]= 'x';
>> +    new_did->s[len]= 'x';
>>       new_did->len = len;
>>   }
>>
>>
>> ______________________________**_________________
>> sr-dev mailing list
>> sr-dev at lists.sip-router.org
>> http://lists.sip-router.org/**cgi-bin/mailman/listinfo/sr-**dev<http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev>
>>
>
>
> --
> Hugh Waite
> Principal Design Engineer
> Crocodile RCS Ltd.
>
>
>
> ______________________________**_________________
> sr-dev mailing list
> sr-dev at lists.sip-router.org
> http://lists.sip-router.org/**cgi-bin/mailman/listinfo/sr-**dev<http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-dev/attachments/20130402/372e07c1/attachment.htm>