Module: kamailio Branch: master Commit: 8cdbe797a659a431e7edc269c81ef40148413b30 URL: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: 2015-01-20T19:10:31+02:00 ims_registrar_scscf: Check length of the contents before trying copy the contents to the buffer (Bug-Fix) --- Modified: modules/ims_registrar_scscf/registrar_notify.c --- Diff: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40… Patch: https://github.com/kamailio/kamailio/commit/8cdbe797a659a431e7edc269c81ef40… --- diff --git a/modules/ims_registrar_scscf/registrar_notify.c b/modules/ims_registrar_scscf/registrar_notify.c index 2ab9ec0..0118cfb 100644 --- a/modules/ims_registrar_scscf/registrar_notify.c +++ b/modules/ims_registrar_scscf/registrar_notify.c @@ -1879,6 +1879,11 @@ reg_notification * new_notification(str subscription_state, str buf; char bufc[MAX_REGINFO_SIZE]; + if (content.len > MAX_REGINFO_SIZE) { + LM_ERR("content size (%d) exceeds MAX_REGINFO_SIZE (%d)!\n", content.len, MAX_REGINFO_SIZE); + return 0; + } + sprintf(bufc, content.s, r->version); buf.s = bufc; buf.len = strlen(bufc);