Explorar o código

In get_to_uid() throw an error when username is empty. Judging by the
fact that the get_to_uid() is trying to do zero-byte copy and underlying
consumers doing other nasty things such as trying to allocate 0-byte
memory buffer nobody expects this condition to happen.

Sponsored by: Sippy Software, Inc.
Debugging: mpatrol

Maxim Sobolev %!s(int64=17) %!d(string=hai) anos
pai
achega
a78ea556d3
Modificáronse 1 ficheiros con 4 adicións e 0 borrados
  1. 4 0
      id.c

+ 4 - 0
id.c

@@ -159,6 +159,10 @@ int get_to_uid(str* uid, struct sip_msg* msg)
 			DBG("get_to_uid: Username too long\n");
 			return -1;
 		}
+		if (p == NULL || uid->len == 0) {
+			DBG("get_to_uid: Username is empty\n");
+			return -1;
+		}
 		memcpy(buf, p, uid->len);
 		uid->s = buf;
 		strlower(uid);