Module: kamailio
Branch: master
Commit: 57794cd14205a16ed6c649fadb4efffca1561986
URL: 
https://github.com/kamailio/kamailio/commit/57794cd14205a16ed6c649fadb4efffca1561986

Author: Daniel-Constantin Mierla <[email protected]>
Committer: Daniel-Constantin Mierla <[email protected]>
Date: 2023-11-30T19:01:52+01:00

ims_ipsec_pcscf: fill_contact() check for port size in alias

---

Modified: src/modules/ims_ipsec_pcscf/cmd.c

---

Diff:  
https://github.com/kamailio/kamailio/commit/57794cd14205a16ed6c649fadb4efffca1561986.diff
Patch: 
https://github.com/kamailio/kamailio/commit/57794cd14205a16ed6c649fadb4efffca1561986.patch

---

diff --git a/src/modules/ims_ipsec_pcscf/cmd.c 
b/src/modules/ims_ipsec_pcscf/cmd.c
index 906fc3eec53..164ded5e2c1 100644
--- a/src/modules/ims_ipsec_pcscf/cmd.c
+++ b/src/modules/ims_ipsec_pcscf/cmd.c
@@ -238,7 +238,7 @@ static int fill_contact(
                }
                if(alias_start != NULL && *(alias_start - 1) == ';') {
                        char *p, *port_s, *proto_s;
-                       char portbuf[5];
+                       char portbuf[6];
                        str alias_s;
 
                        LM_DBG("contact has an alias [%.*s] - use that as the 
received\n",
@@ -267,12 +267,16 @@ static int fill_contact(
                                port_s = p + 1;
                                p = _strnistr(port_s, "~", alias_s.len - 
ci->received_host.len);
                                if(p != NULL) {
-                                       memset(portbuf, 0, 5);
+                                       if((p - port_s)>5) {
+                                               LM_ERR("invalid port value\n");
+                                               return -1;
+                                       }
+                                       memset(portbuf, 0, 6);
                                        memcpy(portbuf, port_s, (p - port_s));
                                        ci->received_port = atoi(portbuf);
 
                                        proto_s = p + 1;
-                                       memset(portbuf, 0, 5);
+                                       memset(portbuf, 0, 6);
                                        memcpy(portbuf, proto_s, 1);
                                        ci->received_proto = atoi(portbuf);
 

_______________________________________________
Kamailio (SER) - Development Mailing List
To unsubscribe send an email to [email protected]

Reply via email to