diff options
| author | Kevin P. Fleming <kpfleming@digium.com> | 2006-08-16 18:58:43 +0000 |
|---|---|---|
| committer | Kevin P. Fleming <kpfleming@digium.com> | 2006-08-16 18:58:43 +0000 |
| commit | e441faab72ee65354586deabe4a552596b8afa1c (patch) | |
| tree | 409ac9d39747ec5ad42f8b044141fcbf09bf0c90 /channels | |
| parent | 7546de3d8eb4243b59c66d697265d0b3782908cb (diff) | |
Merged revisions 40057 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.2
........
r40057 | kpfleming | 2006-08-16 13:57:44 -0500 (Wed, 16 Aug 2006) | 2 lines
don't allow AUEP responses to overflow the stack during a string copy (reported by Mu Security)
........
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@40058 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_mgcp.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c index 07da3a75d..434d2ece0 100644 --- a/channels/chan_mgcp.c +++ b/channels/chan_mgcp.c @@ -2460,12 +2460,14 @@ static void handle_response(struct mgcp_endpoint *p, struct mgcp_subchannel *sub if (strncasecmp(v, p->sub->cxident, len) && strncasecmp(v, p->sub->next->cxident, len)) { /* connection id not found. delete it */ - char cxident[80]; - memcpy(cxident, v, len); - cxident[len] = '\0'; + char cxident[80] = ""; + + if (len > (sizeof(cxident) - 1)) + len = sizeof(cxident) - 1; + ast_copy_string(cxident, v, len); if (option_verbose > 2) { ast_verbose(VERBOSE_PREFIX_3 "Non existing connection id %s on %s@%s \n", - cxident, p->name, gw->name); + cxident, p->name, gw->name); } transmit_connection_del_w_params(p, NULL, cxident); } |