[kamailio/kamailio] pv_headers: fix possible mem. overflow issue and wrong size string (PR #3095)
<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [X] Commit message has the format required by CONTRIBUTING guide - [X] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [X] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [X] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description <!-- Describe your changes in detail --> - remove a variable creation Put two variable accessible to the entire function, renaming one to have some clarity. Remove the useless variable.
- Change from using snprintf to memset (no more \0 at last position) This fix possible a memory overflow while using `snprintf`. This also add a \0 at the end of the structure, so a more direct approach with `memset` was used.
- change the destination of an allocated space being smaller than the source Elements were being put into a smaller string, this commit makes the destination bigger then the source. You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3095
-- Commit Summary --
* pv_headers: fix possible mem. overflow issue and wrong size string
-- File Changes --
M src/modules/pv_headers/pvh_func.c (26)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3095.patch https://github.com/kamailio/kamailio/pull/3095.diff
@miconda commented on this pull request.
if (result == NULL || t == NULL) { PKG_MEM_ERROR; goto clean; }
- snprintf(result, elements->len - toRemove->len, "%*s", elements->len - toRemove->len, ""); - snprintf(t, elements->len+1, "%s", elements->s); + memset(result, 32, elements->len - toRemove->len);
What is the purpose of filling `result` buffer with space (char code `32`)?
}
}
if (elements->len-toRemove->len > 0) { - snprintf(elements->s, elements->len, "%*s", elements->len-toRemove->len, ""); + memset(elements->s, 32, elements->len - toRemove->len); snprintf(elements->s, (strlen(result)%elements->len)+1, "%s", result);
Another `memset` with char code 32 (space), then `snprintf` in the same buffer.
Maybe it is ok, but `memset` with `space` is quite unusual, therefore asking for further details.
@Tomohare pushed 1 commit.
2dd2daa4756b8efe3cdba07616b39410068b9c5f pv_headers: fix possible mem. overflow issue and wrong size string
@Tomohare commented on this pull request.
if (result == NULL || t == NULL) { PKG_MEM_ERROR; goto clean; }
- snprintf(result, elements->len - toRemove->len, "%*s", elements->len - toRemove->len, ""); - snprintf(t, elements->len+1, "%s", elements->s); + memset(result, 32, elements->len - toRemove->len);
Yes, here this is strange. No need of this line entirely.
@Tomohare commented on this pull request.
}
}
if (elements->len-toRemove->len > 0) { - snprintf(elements->s, elements->len, "%*s", elements->len-toRemove->len, ""); + memset(elements->s, 32, elements->len - toRemove->len); snprintf(elements->s, (strlen(result)%elements->len)+1, "%s", result);
As above, this is not needed here.
@Tomohare were all previous remarks addressed from your latest pushed version? @linuxmaniac any remarks from your side as well?
Merged #3095 into master.
-
Daniel-Constantin Mierla -
Henning Westerholt
-
Tomohare
-
Victor Seva