[sr-dev] git:master:b8458c65: ims_registrar_scscf: Safety check the length of the destination string

[Carsten Bock]

Module: kamailio
Branch: master
Commit: b8458c65917c1b1fe9b94bae795dcdb75ecf4f07
URL: https://github.com/kamailio/kamailio/commit/b8458c65917c1b1fe9b94bae795dcdb75ecf4f07

Author: Carsten Bock <carsten at ng-voice.com>
Committer: Carsten Bock <carsten at ng-voice.com>
Date: 2015-11-03T17:34:18+01:00

ims_registrar_scscf: Safety check the length of the destination string

---

Modified: modules/ims_registrar_scscf/registrar_notify.c

---

Diff:  https://github.com/kamailio/kamailio/commit/b8458c65917c1b1fe9b94bae795dcdb75ecf4f07.diff
Patch: https://github.com/kamailio/kamailio/commit/b8458c65917c1b1fe9b94bae795dcdb75ecf4f07.patch

---

diff --git a/modules/ims_registrar_scscf/registrar_notify.c b/modules/ims_registrar_scscf/registrar_notify.c
index c0e6aec..77abf90 100644
--- a/modules/ims_registrar_scscf/registrar_notify.c
+++ b/modules/ims_registrar_scscf/registrar_notify.c
@@ -2024,10 +2024,8 @@ reg_notification * new_notification(str subscription_state,
         return 0;
     }
 
-    sprintf(bufc, content.s, r->version);
     buf.s = bufc;
-    buf.len = strlen(bufc);
-
+    buf.len = snprintf(buf.s, MAX_REGINFO_SIZE, content.s, r->version);
 
     int len;
     char *p;