Module: kamailio Branch: 5.8 Commit: 924ddef08e5d21aecd5b09fd0b43e98c67779a89 URL: https://github.com/kamailio/kamailio/commit/924ddef08e5d21aecd5b09fd0b43e98c67779a89
Author: Lucian Balaceanu <[email protected]> Committer: Lucian Balaceanu <[email protected]> Date: 2026-06-10T14:44:09+03:00 carrierroute: fix for get_rpc_opts corrupts memory - previously get_rpc_opts would write null character past the end of buf (cherry picked from commit 2cf650f2d6e225827471293f71c728d10b4d716d) --- Modified: src/modules/carrierroute/cr_rpc_helper.c --- Diff: https://github.com/kamailio/kamailio/commit/924ddef08e5d21aecd5b09fd0b43e98c67779a89.diff Patch: https://github.com/kamailio/kamailio/commit/924ddef08e5d21aecd5b09fd0b43e98c67779a89.patch --- diff --git a/src/modules/carrierroute/cr_rpc_helper.c b/src/modules/carrierroute/cr_rpc_helper.c index 050c9305f26..3b1a4476073 100644 --- a/src/modules/carrierroute/cr_rpc_helper.c +++ b/src/modules/carrierroute/cr_rpc_helper.c @@ -33,7 +33,7 @@ static int str_toklen(str *str, const char *delims) { int len; - if((str == NULL) || (str->s == NULL)) { + if((str == NULL) || (str->s == NULL) || (str->len <= 0)) { /* No more tokens */ return -1; } @@ -376,14 +376,13 @@ int get_rpc_opts(str *buf, rpc_opt_t *opts, unsigned int opt_set[]) int i, op = -1; unsigned int used_opts = 0; int toklen; + char prob_buf[256]; memset(opt_argv, 0, sizeof(opt_argv)); memset(opts, 0, sizeof(rpc_opt_t)); opts->prob = -1; while((toklen = str_toklen(buf, " \t\r\n")) >= 0 && opt_argc < 20) { - buf->s[toklen] = - '\0'; /* insert zero termination, since strtod might be used later on it */ opt_argv[opt_argc].len = toklen; opt_argv[opt_argc].s = buf->s; buf->s += toklen + 1; @@ -475,8 +474,16 @@ int get_rpc_opts(str *buf, rpc_opt_t *opts, unsigned int opt_set[]) op = -1; break; case OPT_PROB: - opts->prob = strtod(opt_argv[i].s, - NULL); /* we can use str.s since we zero terminated it earlier */ + // copy the opt[i] string to a zero-terminated buffer since strtod needs that + if(opt_argv[i].len >= (int)sizeof(prob_buf)) { + FIFO_ERR(E_WRONGOPT); + LM_ERR("probability value too long: %.*s\n", + opt_argv[i].len, opt_argv[i].s); + return -1; + } + memcpy(prob_buf, opt_argv[i].s, opt_argv[i].len); + prob_buf[opt_argv[i].len] = '\0'; + opts->prob = strtod(prob_buf, NULL); op = -1; break; case OPT_R_PREFIX: _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
