Module: kamailio
Branch: master
Commit: 08a65ecc2e534786eddcea4ccbb3c17e42f8a349
URL: 
https://github.com/kamailio/kamailio/commit/08a65ecc2e534786eddcea4ccbb3c17e42f8a349

Author: Daniel-Constantin Mierla <[email protected]>
Committer: Daniel-Constantin Mierla <[email protected]>
Date: 2025-11-02T17:30:50+01:00

core: parser - check for boundary in decode_mime_type()

- GH #4451

---

Modified: src/core/parser/parse_content.c

---

Diff:  
https://github.com/kamailio/kamailio/commit/08a65ecc2e534786eddcea4ccbb3c17e42f8a349.diff
Patch: 
https://github.com/kamailio/kamailio/commit/08a65ecc2e534786eddcea4ccbb3c17e42f8a349.patch

---

diff --git a/src/core/parser/parse_content.c b/src/core/parser/parse_content.c
index 69392cc8bc6..d15db3d6d78 100644
--- a/src/core/parser/parse_content.c
+++ b/src/core/parser/parse_content.c
@@ -299,7 +299,8 @@ char *decode_mime_type(
        /* search the beginning of the type */
        while(p < end
                        && (*p == ' ' || *p == '\t'
-                                       || (*p == '\n' && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
+                                       || (*p == '\n' && p + 1 < end
+                                                       && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
                p++;
        if(p == end)
                goto error;
@@ -338,7 +339,8 @@ char *decode_mime_type(
        /* search the '/' separator */
        while(p < end
                        && (*p == ' ' || *p == '\t'
-                                       || (*p == '\n' && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
+                                       || (*p == '\n' && p + 1 < end
+                                                       && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
                p++;
        if(p == end || *(p++) != '/')
                goto error;
@@ -346,7 +348,8 @@ char *decode_mime_type(
        /* search the beginning of the sub-type */
        while(p < end
                        && (*p == ' ' || *p == '\t'
-                                       || (*p == '\n' && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
+                                       || (*p == '\n' && p + 1 < end
+                                                       && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
                p++;
        if(p == end)
                goto error;
@@ -385,7 +388,8 @@ char *decode_mime_type(
        /* now it is possible to have some spaces */
        while(p < end
                        && (*p == ' ' || *p == '\t'
-                                       || (*p == '\n' && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
+                                       || (*p == '\n' && p + 1 < end
+                                                       && (*(p + 1) == ' ' || 
*(p + 1) == '\t'))))
                p++;
 
        /* if there are params, ignore them!! -> eat everything to

_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the 
sender!

Reply via email to