git:master:8cdbe797: ims_registrar_scscf: Check length of the contents before trying copy the contents to the buffer (Bug-Fix)
Module: kamailio Branch: master Commit: 8cdbe797a659a431e7edc269c81ef40148413b30 URL: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef401...
Author: Carsten Bock carsten@ng-voice.com Committer: Carsten Bock carsten@ng-voice.com Date: 2015-01-20T19:10:31+02:00
ims_registrar_scscf: Check length of the contents before trying copy the contents to the buffer (Bug-Fix)
---
Modified: modules/ims_registrar_scscf/registrar_notify.c
---
Diff: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef401... Patch: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef401...
---
diff --git a/modules/ims_registrar_scscf/registrar_notify.c b/modules/ims_registrar_scscf/registrar_notify.c index 2ab9ec0..0118cfb 100644 --- a/modules/ims_registrar_scscf/registrar_notify.c +++ b/modules/ims_registrar_scscf/registrar_notify.c @@ -1879,6 +1879,11 @@ reg_notification * new_notification(str subscription_state, str buf; char bufc[MAX_REGINFO_SIZE];
+ if (content.len > MAX_REGINFO_SIZE) { + LM_ERR("content size (%d) exceeds MAX_REGINFO_SIZE (%d)!\n", content.len, MAX_REGINFO_SIZE); + return 0; + } + sprintf(bufc, content.s, r->version); buf.s = bufc; buf.len = strlen(bufc);
-
Carsten Bock