Sfoglia il codice sorgente

In get_to_uid() throw an error when username is empty. Judging by the
fact that the get_to_uid() is trying to do zero-byte copy and underlying
consumers doing other nasty things such as trying to allocate 0-byte
memory buffer nobody expects this condition to happen.

Sponsored by: Sippy Software, Inc.
Debugging: mpatrol

Maxim Sobolev 17 anni fa
parent
commit
a78ea556d3
1 ha cambiato i file con 4 aggiunte e 0 eliminazioni
  1. 4 0
      id.c

+ 4 - 0
id.c

@@ -159,6 +159,10 @@ int get_to_uid(str* uid, struct sip_msg* msg)
 			DBG("get_to_uid: Username too long\n");
 			return -1;
 		}
+		if (p == NULL || uid->len == 0) {
+			DBG("get_to_uid: Username is empty\n");
+			return -1;
+		}
 		memcpy(buf, p, uid->len);
 		uid->s = buf;
 		strlower(uid);