From edfbb31821852617d0fab0d1878d6c82a3d75d3d Mon Sep 17 00:00:00 2001
From: Nanang Izzuddin <nanang@teluu.com>
Date: Mon, 14 Mar 2016 06:40:45 +0000
Subject: Misc (re #1882): Fixed crash due to insufficient buffer in printing
 video device capabilities and formats in pjsua app.

git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@5259 74dad513-b988-da41-8d7b-12977e46ad98
---
 pjsip-apps/src/pjsua/pjsua_app_common.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/pjsip-apps/src/pjsua/pjsua_app_common.c b/pjsip-apps/src/pjsua/pjsua_app_common.c
index d2ca0b64..0d57da14 100644
--- a/pjsip-apps/src/pjsua/pjsua_app_common.c
+++ b/pjsip-apps/src/pjsua/pjsua_app_common.c
@@ -270,9 +270,10 @@ void arrange_window(pjsua_vid_win_id wid)
 void vid_print_dev(int id, const pjmedia_vid_dev_info *vdi, const char *title)
 {
     char capnames[120];
-    char formats[120];
+    char formats[200];
     const char *dirname;
     unsigned i;
+    int st_len;
 
     if (vdi->dir == PJMEDIA_DIR_CAPTURE_RENDER) {
 	dirname = "capture, render";
@@ -284,33 +285,47 @@ void vid_print_dev(int id, const pjmedia_vid_dev_info *vdi, const char *title)
 
 
     capnames[0] = '\0';
+    st_len = 0;
     for (i=0; i<sizeof(int)*8 && (1 << i) < PJMEDIA_VID_DEV_CAP_MAX; ++i) {
 	if (vdi->caps & (1 << i)) {
 	    const char *capname = pjmedia_vid_dev_cap_name(1 << i, NULL);
 	    if (capname) {
+		int tmp_len = strlen(capname);
+		if ((int)sizeof(capnames) - st_len <= tmp_len)
+		    break;
+
+		st_len += (tmp_len + 2);
 		if (*capnames)
 		    strcat(capnames, ", ");
-		strncat(capnames, capname,
-		        sizeof(capnames)-strlen(capnames)-1);
+		strcat(capnames, capname);
 	    }
 	}
     }
 
     formats[0] = '\0';
+    st_len = 0;
     for (i=0; i<vdi->fmt_cnt; ++i) {
 	const pjmedia_video_format_info *vfi =
 		pjmedia_get_video_format_info(NULL, vdi->fmt[i].id);
 	if (vfi) {
+	    int tmp_len = strlen(vfi->name);
+	    if ((int)sizeof(formats) - st_len <= tmp_len) {
+		st_len = -1;
+		break;
+	    }
+
+	    st_len += (tmp_len + 2);
 	    if (*formats)
 		strcat(formats, ", ");
-	    strncat(formats, vfi->name, sizeof(formats)-strlen(formats)-1);
+	    strcat(formats, vfi->name);
 	}
     }
 
     PJ_LOG(3,(THIS_FILE, "%3d %s [%s][%s] %s", id, vdi->name, vdi->driver,
 	      dirname, title));
     PJ_LOG(3,(THIS_FILE, "    Supported capabilities: %s", capnames));
-    PJ_LOG(3,(THIS_FILE, "    Supported formats: %s", formats));
+    PJ_LOG(3,(THIS_FILE, "    Supported formats: %s%s", formats,
+			      (st_len<0? " ..." : "")));
 }
 
 void vid_list_devs()
-- 
cgit v1.2.3