[sr-dev] git:master:8cdbe797: ims_registrar_scscf: Check length of the contents before trying copy the contents to the buffer (Bug-Fix)

[Carsten Bock]

Module: kamailio
Branch: master
Commit: 8cdbe797a659a431e7edc269c81ef40148413b30
URL: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40148413b30

Author: Carsten Bock <carsten at ng-voice.com>
Committer: Carsten Bock <carsten at ng-voice.com>
Date: 2015-01-20T19:10:31+02:00

ims_registrar_scscf: Check length of the contents before trying copy the contents to the buffer (Bug-Fix)

---

Modified: modules/ims_registrar_scscf/registrar_notify.c

---

Diff:  https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40148413b30.diff
Patch: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40148413b30.patch

---

diff --git a/modules/ims_registrar_scscf/registrar_notify.c b/modules/ims_registrar_scscf/registrar_notify.c
index 2ab9ec0..0118cfb 100644
--- a/modules/ims_registrar_scscf/registrar_notify.c
+++ b/modules/ims_registrar_scscf/registrar_notify.c
@@ -1879,6 +1879,11 @@ reg_notification * new_notification(str subscription_state,
     str buf;
     char bufc[MAX_REGINFO_SIZE];
 
+    if (content.len > MAX_REGINFO_SIZE) {
+        LM_ERR("content size (%d) exceeds MAX_REGINFO_SIZE (%d)!\n", content.len, MAX_REGINFO_SIZE);
+        return 0;
+    }
+
     sprintf(bufc, content.s, r->version);
     buf.s = bufc;
     buf.len = strlen(bufc);