[sr-dev] Re: [kamailio/kamailio] possible memory corruption in sipcapture module (Issue #3835)

I am not a C developer so I have to guess here. For me it looks like the `static` address of `buff` is returned by `ip_addr2a`. ```c char *ip_addr2a(struct ip_addr *ip) { static char buff[IP_ADDR_MAX_STR_SIZE]; // ... return buff; } ``` -- https://github.com/kamailio/kamailio/blob/1535031a6c992c23270050793b23d290a… If that's the case, I think every user of that function should copy the value from that address instead of remembering the address. Otherwise it is always the same address for every call of `ip_addr2a` and subsequent calls overwrite the value of the previous call. Unfortunately, the sipcapture module uses the returned value directly: ```c si->address_str.s = ip_addr2a(&si->address); ``` -- https://github.com/kamailio/kamailio/blob/1535031a6c992c23270050793b23d290a… I tested with the following code and I think it confirms my theory because `foo` changes to "bar". ```c #include <stdio.h> #include <string.h> char *a(char* in); int main() { char *foo = a("foo"); printf("foo %08x -> %08x = %s\n", &foo, foo, foo); char *bar = a("bar"); printf("foo %08x -> %08x = %s\n", &foo, foo, foo); printf("bar %08x -> %08x = %s\n", &bar, bar, bar); } char *a(char* in) { static char out[10]; strcpy(out, in); return out; } ``` Output: ```plain foo 0c3399d8 -> b37ba018 = foo foo 0c3399d8 -> b37ba018 = bar bar 0c3399e0 -> b37ba018 = bar ``` However, I can't explain why this should be any different in previous kamailio versions. -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3835#issuecomment-2104328063 You are receiving this because you are subscribed to this thread. Message ID: &lt;kamailio/kamailio/issues/3835/2104328063(a)github.com&gt;