[sr-dev] git:master:1f4e0faa: pv: trans - check for number parameter limit

Module: kamailio Branch: master Commit: 1f4e0faac577a1bd4826e0bafe451d66b8aa360c URL: https://github.com/kamailio/kamailio/commit/1f4e0faac577a1bd4826e0bafe451d6… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2023-11-13T10:58:01+01:00 pv: trans - check for number parameter limit --- Modified: src/modules/pv/pv_trans.c --- Diff: https://github.com/kamailio/kamailio/commit/1f4e0faac577a1bd4826e0bafe451d6… Patch: https://github.com/kamailio/kamailio/commit/1f4e0faac577a1bd4826e0bafe451d6… --- diff --git a/src/modules/pv/pv_trans.c b/src/modules/pv/pv_trans.c index 5204c8fa22c..48557ca977d 100644 --- a/src/modules/pv/pv_trans.c +++ b/src/modules/pv/pv_trans.c @@ -2563,6 +2563,10 @@ int tr_eval_val( && (*_p == ' ' || *_p == '\t' || *_p == '\n')) \ _p++; \ while(is_in_str(_p, _in) && *_p >= '0' && *_p <= '9') { \ + if(_n > ((INT_MAX / 10) - 10)) { \ + LM_ERR("number value is too large\n"); \ + goto error; \ + } \ _n = _n * 10 + *_p - '0'; \ _p++; \ } \