Pārlūkot izejas kodu

nathelper(k): fix for very long payload-type

- fix SF: #2813924: publishing very long payload-type to the rtp-proxy
  overflows a buffer
- patch by Marcus Hunger
Daniel-Constantin Mierla 16 gadi atpakaļ
vecāks
revīzija
8c97cfc35f
1 mainītis faili ar 3 papildinājumiem un 1 dzēšanām
  1. 3 1
      modules_k/nathelper/nathelper.c

+ 3 - 1
modules_k/nathelper/nathelper.c

@@ -2779,7 +2779,9 @@ force_rtp_proxy(struct sip_msg* msg, char* str1, char* str2, int offer)
 					 * a comma-separated list.
 					 */
 					for (cp = payload_types.s;
-					    cp < payload_types.s + payload_types.len; cp++) {
+							(cp < payload_types.s + payload_types.len) &&
+							(cp1 - (char *)v[1].iov_base < sizeof(opts) - 1);
+							cp++) {
 						if (isdigit(*cp)) {
 							*cp1 = *cp;
 							cp1++;