[sr-dev] git:master:91596953: sdpops: safety check when location a= line not to exceed end of message

Daniel-Constantin Mierla miconda at gmail.com
Mon Feb 23 14:31:19 CET 2015


Module: kamailio
Branch: master
Commit: 91596953115fe1bbe5c6f0dd0dd6e8d99cdbd285
URL: https://github.com/kamailio/kamailio/commit/91596953115fe1bbe5c6f0dd0dd6e8d99cdbd285

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date: 2015-02-23T14:29:46+01:00

sdpops: safety check when location a= line not to exceed end of message

---

Modified: modules/sdpops/sdpops_mod.c

---

Diff:  https://github.com/kamailio/kamailio/commit/91596953115fe1bbe5c6f0dd0dd6e8d99cdbd285.diff
Patch: https://github.com/kamailio/kamailio/commit/91596953115fe1bbe5c6f0dd0dd6e8d99cdbd285.patch

---

diff --git a/modules/sdpops/sdpops_mod.c b/modules/sdpops/sdpops_mod.c
index 3357bb2..2a4aa6b 100644
--- a/modules/sdpops/sdpops_mod.c
+++ b/modules/sdpops/sdpops_mod.c
@@ -159,12 +159,17 @@ static int mod_init(void)
 int sdp_locate_line(sip_msg_t* msg, char *pos, str *aline)
 {
 	char *p;
+	char *bend;
+
 	p = pos;
 	while(*p!='\n') p--;
 	aline->s = p + 1;
 	p = pos;
-	while(*p!='\n') p++;
+	bend = msg->buf+msg->len;
+	while(*p!='\n' && p<bend) p++;
 	aline->len = p - aline->s + 1;
+	if(unlikely(p==bend)) aline->len--;
+
 	return 0;
 }
 




More information about the sr-dev mailing list