kenmirrors/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2025-02-07 22:03:50 +00:00
Code Issues Projects Releases Wiki Activity

[mod_sofia] Fix potential buffer overrun when rewrite_multicasted_fs_path is enabled.

Browse Source
This commit is contained in:
Nick Lemberger 2020-01-24 17:23:26 -06:00 committed by Andrey Volk
parent 890dac9972
commit 4fa0870ef0
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/mod/endpoints/mod_sofia/sofia.c
View File

@ -2807,8 +2807,23 @@ void event_handler(switch_event_t *event)
if (mod_sofia_globals.rewrite_multicasted_fs_path && contact_str) { if (mod_sofia_globals.rewrite_multicasted_fs_path && contact_str) {
const char *needle = ";fs_path="; const char *needle = ";fs_path=";
char *sptr, *eptr = NULL; char *sptr, *eptr = NULL;
/* allocate enough room for worst-case scenario */ /* allocate enough room for worst-case scenario, depends on rewrite_multicased_fs_path setting */
size_t len = strlen(contact_str) + strlen(to_host) + 14; size_t len;
switch (mod_sofia_globals.rewrite_multicasted_fs_path) {
case 1:
len = strlen(contact_str) + strlen(to_host) + 14;
break;
case 2:
len = strlen(contact_str) + strlen(orig_server_host) + 14;
break;
case 3:
len = strlen(contact_str) + strlen(orig_hostname) + 14;
break;
default:
len = strlen(contact_str) + strlen(to_host) + 14;
break;
}
fixed_contact_str = malloc(len); fixed_contact_str = malloc(len);
switch_assert(fixed_contact_str); switch_assert(fixed_contact_str);
switch_copy_string(fixed_contact_str, contact_str, len); switch_copy_string(fixed_contact_str, contact_str, len);