瀏覽代碼

nathelper(k): safety check for content length

- patch by Marcus Hunger, SF#2961414
(cherry picked from commit fb4f98a341322904a92c6f12396f5795a3275c08)
Daniel-Constantin Mierla 15 年之前
父節點
當前提交
682ef1b610
共有 1 個文件被更改,包括 7 次插入1 次删除
  1. 7 1
      modules_k/nathelper/nhelpr_funcs.c

+ 7 - 1
modules_k/nathelper/nhelpr_funcs.c

@@ -196,7 +196,13 @@ int extract_body(struct sip_msg *msg, str *body )
 		LM_ERR("message body has length zero\n");
 		goto error;
 	}
-	
+
+	if (body->len + body->s > msg->buf + msg->len) {
+		LM_ERR("content-length exceeds packet-length by %d\n",
+				(body->len + body->s) - (msg->buf + msg->len));
+		goto error;
+	}
+
 	/* no need for parse_headers(msg, EOH), get_body will 
 	 * parse everything */
 	/*is the content type correct?*/