kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-02 02:18:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip_pubsub.c: Fix one byte buffer overrun error.

Browse Source 
ast_sip_pubsub_register_body_generator() did not account for the null
terminator set by sprintf() in the allocated output buffer.

Change-Id: I388688a132e479bca6ad1c19275eae0070969ae2
This commit is contained in:
Richard Mudgett
2015-08-21 15:26:30 -05:00
parent 08a182c8e6
commit 2b30fc2b2d
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
res/res_pjsip_pubsub.c
View File

@@ -2995,16 +2995,13 @@ int ast_sip_pubsub_register_body_generator(struct ast_sip_pubsub_body_generator
AST_LIST_INSERT_HEAD(&body_generators, generator, list); AST_LIST_INSERT_HEAD(&body_generators, generator, list);
AST_RWLIST_UNLOCK(&body_generators); AST_RWLIST_UNLOCK(&body_generators);
/* Lengths of type and subtype plus space for a slash. pj_str_t is not /* Lengths of type and subtype plus a slash. */
* null-terminated, so there is no need to allocate for the extra null
* byte
*/
accept_len = strlen(generator->type) + strlen(generator->subtype) + 1; accept_len = strlen(generator->type) + strlen(generator->subtype) + 1;
accept.ptr = ast_alloca(accept_len); /* Add room for null terminator that sprintf() will set. */
accept.slen = accept_len; pj_strset(&accept, ast_alloca(accept_len + 1), accept_len);
/* Safe use of sprintf */ sprintf((char *) pj_strbuf(&accept), "%s/%s", generator->type, generator->subtype);/* Safe */
sprintf(accept.ptr, "%s/%s", generator->type, generator->subtype);
pjsip_endpt_add_capability(ast_sip_get_pjsip_endpoint(), &pubsub_module, pjsip_endpt_add_capability(ast_sip_get_pjsip_endpoint(), &pubsub_module,
PJSIP_H_ACCEPT, NULL, 1, &accept); PJSIP_H_ACCEPT, NULL, 1, &accept);