diff options
| author | Richard Mudgett <rmudgett@digium.com> | 2015-08-21 15:26:30 -0500 |
|---|---|---|
| committer | Richard Mudgett <rmudgett@digium.com> | 2015-09-10 13:16:12 -0500 |
| commit | 2b30fc2b2d822f06169d14592d0bd10b8d2547fb (patch) | |
| tree | 0da83de2dfdf8619d4c40b6f1c3142bacdb9e3fd /res/res_pjsip_pubsub.c | |
| parent | 08a182c8e61e336dbf1a467b4c6677cef6ccac6c (diff) | |
res_pjsip_pubsub.c: Fix one byte buffer overrun error.
ast_sip_pubsub_register_body_generator() did not account for the null
terminator set by sprintf() in the allocated output buffer.
Change-Id: I388688a132e479bca6ad1c19275eae0070969ae2
Diffstat (limited to 'res/res_pjsip_pubsub.c')
| -rw-r--r-- | res/res_pjsip_pubsub.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/res/res_pjsip_pubsub.c b/res/res_pjsip_pubsub.c index 2a8d417fb..3af33a1e2 100644 --- a/res/res_pjsip_pubsub.c +++ b/res/res_pjsip_pubsub.c @@ -2995,16 +2995,13 @@ int ast_sip_pubsub_register_body_generator(struct ast_sip_pubsub_body_generator AST_LIST_INSERT_HEAD(&body_generators, generator, list); AST_RWLIST_UNLOCK(&body_generators); - /* Lengths of type and subtype plus space for a slash. pj_str_t is not - * null-terminated, so there is no need to allocate for the extra null - * byte - */ + /* Lengths of type and subtype plus a slash. */ accept_len = strlen(generator->type) + strlen(generator->subtype) + 1; - accept.ptr = ast_alloca(accept_len); - accept.slen = accept_len; - /* Safe use of sprintf */ - sprintf(accept.ptr, "%s/%s", generator->type, generator->subtype); + /* Add room for null terminator that sprintf() will set. */ + pj_strset(&accept, ast_alloca(accept_len + 1), accept_len); + sprintf((char *) pj_strbuf(&accept), "%s/%s", generator->type, generator->subtype);/* Safe */ + pjsip_endpt_add_capability(ast_sip_get_pjsip_endpoint(), &pubsub_module, PJSIP_H_ACCEPT, NULL, 1, &accept); |