Module: kamailio Branch: 5.2 Commit: 35292bc172e8ad2246b3c7c1e1e576264e70a1de URL: https://github.com/kamailio/kamailio/commit/35292bc172e8ad2246b3c7c1e1e57626...

Author: Henning Westerholt hw@skalatan.de Committer: Henning Westerholt hw@skalatan.de Date: 2019-09-21T21:24:19+02:00

core: fix possible int overflow (conversion after multiplication) in cfg code

(cherry picked from commit d1f5a2a266716d4f6759f9e695249dce442ccdd2)

---

Modified: src/core/cfg/cfg_struct.c

---

Diff: https://github.com/kamailio/kamailio/commit/35292bc172e8ad2246b3c7c1e1e57626... Patch: https://github.com/kamailio/kamailio/commit/35292bc172e8ad2246b3c7c1e1e57626...

---

diff --git a/src/core/cfg/cfg_struct.c b/src/core/cfg/cfg_struct.c index f7b1530419..f89e5a0daf 100644 --- a/src/core/cfg/cfg_struct.c +++ b/src/core/cfg/cfg_struct.c @@ -682,7 +682,7 @@ cfg_group_inst_t *cfg_extend_array(cfg_group_meta_t *meta, cfg_group_t *group, if (i > 0) memcpy( new_array, old_array, - inst_size * i); + (size_t) inst_size * i);

memset((char*)new_array + inst_size * i, 0, inst_size); *new_group = (cfg_group_inst_t *)((char*)new_array + inst_size * i); @@ -691,7 +691,7 @@ cfg_group_inst_t *cfg_extend_array(cfg_group_meta_t *meta, cfg_group_t *group, if (i < meta->num) memcpy( (char*)new_array + inst_size * (i + 1), (char*)old_array + inst_size * i, - inst_size * (meta->num - i)); + (size_t) inst_size * (meta->num - i));

return new_array; }