From 4fa0870ef06fcd8a679969c5d194a53f1e4cac63 Mon Sep 17 00:00:00 2001 From: Nick Lemberger Date: Fri, 24 Jan 2020 17:23:26 -0600 Subject: [PATCH] [mod_sofia] Fix potential buffer overrun when rewrite_multicasted_fs_path is enabled. --- src/mod/endpoints/mod_sofia/sofia.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/mod/endpoints/mod_sofia/sofia.c b/src/mod/endpoints/mod_sofia/sofia.c index bf9579f353..31020b3b00 100644 --- a/src/mod/endpoints/mod_sofia/sofia.c +++ b/src/mod/endpoints/mod_sofia/sofia.c @@ -2807,8 +2807,23 @@ void event_handler(switch_event_t *event) if (mod_sofia_globals.rewrite_multicasted_fs_path && contact_str) { const char *needle = ";fs_path="; char *sptr, *eptr = NULL; - /* allocate enough room for worst-case scenario */ - size_t len = strlen(contact_str) + strlen(to_host) + 14; + /* allocate enough room for worst-case scenario, depends on rewrite_multicased_fs_path setting */ + size_t len; + switch (mod_sofia_globals.rewrite_multicasted_fs_path) { + case 1: + len = strlen(contact_str) + strlen(to_host) + 14; + break; + case 2: + len = strlen(contact_str) + strlen(orig_server_host) + 14; + break; + case 3: + len = strlen(contact_str) + strlen(orig_hostname) + 14; + break; + default: + len = strlen(contact_str) + strlen(to_host) + 14; + break; + } + fixed_contact_str = malloc(len); switch_assert(fixed_contact_str); switch_copy_string(fixed_contact_str, contact_str, len);