浏览代码

presence(k): fix off-by-one memory allocation

Due to some missing '()' ( (...)?resource.len:event.len + 1
instead of ((...)?resource.len:event.len) + 1 ) sometimes the
memory allocated was less with one byte then what was needed.
The fixed version also replaces ?: with MAX_unsigned() (does the
same thing and it's easier to read).

Reported-by: Andres Moya  andres.moya.i gmail com
(cherry picked from commit 229bd1f517cb9177dc731929c31153b2b9513215)
Andrei Pelinescu-Onciul 16 年之前
父节点
当前提交
4ef0160262
共有 1 个文件被更改,包括 1 次插入2 次删除
  1. 1 2
      modules_k/presence/notify.c

+ 1 - 2
modules_k/presence/notify.c

@@ -1793,8 +1793,7 @@ str* create_winfo_xml(watcher_t* watchers, char* version,
 		LM_ERR("while adding child\n");
 		goto error;
 	}
-	res= (char*)pkg_malloc((resource.len>event.len)?resource.len:event.len
-			+ 1);
+	res= (char*)pkg_malloc(MAX_unsigned(resource.len, event.len) + 1);
 	if(res== NULL)
 	{
 		ERR_MEM(PKG_MEM_STR);