Module: kamailio Branch: master Commit: d1f5a2a266716d4f6759f9e695249dce442ccdd2 URL: https://github.com/kamailio/kamailio/commit/d1f5a2a266716d4f6759f9e695249dce...

Author: Henning Westerholt hw@skalatan.de Committer: Henning Westerholt hw@skalatan.de Date: 2019-09-21T21:15:12+02:00

core: fix possible int overflow (conversion after multiplication) in cfg code

---

Modified: src/core/cfg/cfg_struct.c

---

Diff: https://github.com/kamailio/kamailio/commit/d1f5a2a266716d4f6759f9e695249dce... Patch: https://github.com/kamailio/kamailio/commit/d1f5a2a266716d4f6759f9e695249dce...

---

diff --git a/src/core/cfg/cfg_struct.c b/src/core/cfg/cfg_struct.c index 0e3f30ae02..49a885d8af 100644 --- a/src/core/cfg/cfg_struct.c +++ b/src/core/cfg/cfg_struct.c @@ -683,7 +683,7 @@ cfg_group_inst_t *cfg_extend_array(cfg_group_meta_t *meta, cfg_group_t *group, if (i > 0) memcpy( new_array, old_array, - inst_size * i); + (size_t) inst_size * i);

memset((char*)new_array + inst_size * i, 0, inst_size); *new_group = (cfg_group_inst_t *)((char*)new_array + inst_size * i); @@ -692,7 +692,7 @@ cfg_group_inst_t *cfg_extend_array(cfg_group_meta_t *meta, cfg_group_t *group, if (i < meta->num) memcpy( (char*)new_array + inst_size * (i + 1), (char*)old_array + inst_size * i, - inst_size * (meta->num - i)); + (size_t) inst_size * (meta->num - i));

return new_array; }