[sr-dev] git:4.2:e24c9ff7: sdpops: safety check when location a= line not to exceed end of message

Module: kamailio Branch: 4.2 Commit: e24c9ff7038534e07682e8a7bafd903e4303590e URL: https://github.com/kamailio/kamailio/commit/e24c9ff7038534e07682e8a7bafd903… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2015-02-23T22:02:51+01:00 sdpops: safety check when location a= line not to exceed end of message (cherry picked from commit 91596953115fe1bbe5c6f0dd0dd6e8d99cdbd285) --- Modified: modules/sdpops/sdpops_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/e24c9ff7038534e07682e8a7bafd903… Patch: https://github.com/kamailio/kamailio/commit/e24c9ff7038534e07682e8a7bafd903… --- diff --git a/modules/sdpops/sdpops_mod.c b/modules/sdpops/sdpops_mod.c index 8717343..98c2f84 100644 --- a/modules/sdpops/sdpops_mod.c +++ b/modules/sdpops/sdpops_mod.c @@ -156,12 +156,17 @@ static int mod_init(void) int sdp_locate_line(sip_msg_t* msg, char *pos, str *aline) { char *p; + char *bend; + p = pos; while(*p!='\n') p--; aline->s = p + 1; p = pos; - while(*p!='\n') p++; + bend = msg->buf+msg->len; + while(*p!='\n' && p<bend) p++; aline->len = p - aline->s + 1; + if(unlikely(p==bend)) aline->len--; + return 0; }