sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

res_pjsip_header_funcs: Duplicate new header value, don't copy. 

When updating an existing header the 'update' code incorrectly
just copied the new value into the existing buffer. If the
new value exceeded the available buffer size memory outside
of the buffer would be written into, potentially causing
a crash.

This change makes it so that the 'update' now duplicates
the new header value instead of copying it into the existing
buffer.
This commit is contained in:
Gitea 2023-07-10 12:43:06 -03:00 committed by asterisk-org-access-app[bot]
parent 39760d109b
commit a1ca026825
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
res/res_pjsip_header_funcs.c
View File

@ -676,6 +676,7 @@ static int add_header(void *obj)
static int update_header(void *obj)
{
struct header_data *data = obj;
pj_pool_t *pool = data->channel->session->inv_session->dlg->pool;
pjsip_hdr *hdr = NULL;
RAII_VAR(struct ast_datastore *, datastore,
ast_sip_session_get_datastore(data->channel->session, data->header_datastore->type),
@ -694,7 +695,7 @@ static int update_header(void *obj)
return -1;
}
pj_strcpy2(&((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
pj_strdup2(pool, &((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
return 0;
}