pv: clone result of several string transformations

- it is safer for assigning back to the same variable on which the
  transformation was applied
- reported by Martin Mikkelsen

modules/pv/pv_trans.c

@@ -95,6 +95,15 @@ char *tr_set_crt_buffer(void)
 	return _tr_buffer;
 }
 
+#define tr_string_clone_result do { \
+		if(val->rs.len>TR_BUFFER_SIZE-1) { \
+			LM_ERR("result is too big\n"); \
+			return -1; \
+		} \
+		strncpy(_tr_buffer, val->rs.s, val->rs.len); \
+		val->rs.s = _tr_buffer; \
+	} while(0);
+
 /*!
  * \brief Evaluate string transformations
  * \param msg SIP message
@@ -350,6 +359,7 @@ int tr_eval_string(struct sip_msg *msg, tr_param_t *tp, int subtype,
 				{ /* to end */
 					val->rs.s += i;
 					val->rs.len -= i;
+					tr_string_clone_result;
 					break;
 				}
 				val->rs.s += i;
@@ -367,10 +377,12 @@ int tr_eval_string(struct sip_msg *msg, tr_param_t *tp, int subtype,
 			{ /* to end */
 				val->rs.s += val->rs.len-i;
 				val->rs.len = i;
+				tr_string_clone_result;
 				break;
 			}
 			val->rs.s += val->rs.len-i;
 			val->rs.len = j;
+			tr_string_clone_result;
 			break;
 
 		case TR_S_SELECT:
@@ -441,6 +453,7 @@ int tr_eval_string(struct sip_msg *msg, tr_param_t *tp, int subtype,
 					val->rs = _tr_empty;
 				}
 			}
+			tr_string_clone_result;
 			break;
 
 		case TR_S_TOLOWER:
@@ -516,6 +529,7 @@ int tr_eval_string(struct sip_msg *msg, tr_param_t *tp, int subtype,
 			if(subtype==TR_S_STRIP)
 				val->rs.s += i;
 			val->rs.len -= i;
+			tr_string_clone_result;
 			break;
 
 
@@ -557,6 +571,7 @@ int tr_eval_string(struct sip_msg *msg, tr_param_t *tp, int subtype,
 			}
 			val->rs.s += i;
 			val->rs.len -= i;
+			tr_string_clone_result;
 			break;
 
 		case TR_S_PREFIXES: