[sr-dev] git:5.1:45ac770d: core: parse - validity check for contact uri size and more verbose log message

Module: kamailio Branch: 5.1 Commit: 45ac770d7e261b4d6d282725de1a5401df8639b6 URL: https://github.com/kamailio/kamailio/commit/45ac770d7e261b4d6d282725de1a540… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Henning Westerholt &lt;hw(a)skalatan.de&gt; Date: 2019-04-11T21:54:45+02:00 core: parse - validity check for contact uri size and more verbose log message (cherry picked from commit 69f9b0a4d5261ec5b6d8d7163b3809a9bb24916d) --- Modified: src/core/parser/contact/contact.c --- Diff: https://github.com/kamailio/kamailio/commit/45ac770d7e261b4d6d282725de1a540… Patch: https://github.com/kamailio/kamailio/commit/45ac770d7e261b4d6d282725de1a540… --- diff --git a/src/core/parser/contact/contact.c b/src/core/parser/contact/contact.c index 4c534ece77..c87e329864 100644 --- a/src/core/parser/contact/contact.c +++ b/src/core/parser/contact/contact.c @@ -182,6 +182,9 @@ int parse_contacts(str* _s, contact_t** _c) { contact_t* c; param_hooks_t hooks; + str sv; + + sv = *_s; while(1) { /* Allocate and clear contact structure */ @@ -220,6 +223,10 @@ int parse_contacts(str* _s, contact_t** _c) } trim(&c->uri); + if((c->uri.len <= 0) || (c->uri.s + c->uri.len > sv.s + sv.len)) { + LM_ERR("invlid contact uri\n"); + goto error; + } if (_s->len == 0) goto ok; @@ -264,6 +271,8 @@ int parse_contacts(str* _s, contact_t** _c) } error: + LM_ERR("failure parsing '%.*s' (%d) [%p/%p/%d]\n", sv.len, sv.s, sv.len, + sv.s, _s->s, (int)(_s->s - sv.s)); if (c) pkg_free(c); free_contacts(_c); /* Free any contacts created so far */ return -1;