Prechádzať zdrojové kódy

nathelper(k): safety check for content length

- patch by Marcus Hunger, SF#2961414
(cherry picked from commit fb4f98a341322904a92c6f12396f5795a3275c08)
Daniel-Constantin Mierla 15 rokov pred
rodič
commit
682ef1b610
1 zmenil súbory, kde vykonal 7 pridanie a 1 odobranie
  1. 7 1
      modules_k/nathelper/nhelpr_funcs.c

+ 7 - 1
modules_k/nathelper/nhelpr_funcs.c

@@ -196,7 +196,13 @@ int extract_body(struct sip_msg *msg, str *body )
 		LM_ERR("message body has length zero\n");
 		goto error;
 	}
-	
+
+	if (body->len + body->s > msg->buf + msg->len) {
+		LM_ERR("content-length exceeds packet-length by %d\n",
+				(body->len + body->s) - (msg->buf + msg->len));
+		goto error;
+	}
+
 	/* no need for parse_headers(msg, EOH), get_body will 
 	 * parse everything */
 	/*is the content type correct?*/