Ver código fonte

In get_to_uid() throw an error when username is empty. Judging by the
fact that the get_to_uid() is trying to do zero-byte copy and underlying
consumers doing other nasty things such as trying to allocate 0-byte
memory buffer nobody expects this condition to happen.

Sponsored by: Sippy Software, Inc.
Debugging: mpatrol

Maxim Sobolev 17 anos atrás
pai
commit
a78ea556d3
1 arquivos alterados com 4 adições e 0 exclusões
  1. 4 0
      id.c

+ 4 - 0
id.c

@@ -159,6 +159,10 @@ int get_to_uid(str* uid, struct sip_msg* msg)
 			DBG("get_to_uid: Username too long\n");
 			return -1;
 		}
+		if (p == NULL || uid->len == 0) {
+			DBG("get_to_uid: Username is empty\n");
+			return -1;
+		}
 		memcpy(buf, p, uid->len);
 		uid->s = buf;
 		strlower(uid);