Changeset 4979 for pjproject/trunk

Timestamp:

Feb 10, 2015 3:20:04 AM (10 years ago)

Author:

ming

Message:

Re #1782 (misc): Prevent buffer overrun in pjsip message/uri printing
Thanks to Sagi Iltus for the patch

Location:

pjproject/trunk/pjsip

Files:

• include/pjsip/print_util.h (modified) (1 diff)
• src/pjsip/sip_msg.c (modified) (1 diff)
• src/pjsip/sip_uri.c (modified) (6 diffs)

pjproject/trunk/pjsip/include/pjsip/print_util.h

@@ -20 +20 @@
 #ifndef __PJSIP_PRINT_H__
 #define __PJSIP_PRINT_H__
+
+#define copy_advance_char_check(buf,chr)   \
+        do { \
+            if (1 >= (endbuf-buf)) return -1;   \
+            *buf++ = chr; \
+        } while (0)
 
 #define copy_advance_check(buf,str)   \

pjproject/trunk/pjsip/src/pjsip/sip_msg.c

@@ -1221 +1221 @@
 
         copy_advance(buf, (*hname));
-        *buf++ = ':';
-        *buf++ = ' ';
+        copy_advance_char_check(buf, ':');
+        copy_advance_char_check(buf, ' ');
 
         printed = pjsip_uri_print(PJSIP_URI_IN_CONTACT_HDR, hdr->uri, 

pjproject/trunk/pjsip/src/pjsip/sip_uri.c

@@ -122 +122 @@
 
     do {
-        *buf++ = (char)sep;
+        copy_advance_char_check(buf, (char)sep);
         copy_advance_escape(buf, p->name, (*pname_spec));
         if (p->value.slen) {
-            *buf++ = '=';
+            copy_advance_char_check(buf, '=');
             if (*p->value.ptr == '"')
                 copy_advance(buf, p->value);
@@ -266 +266 @@
     scheme = pjsip_uri_get_scheme(url);
     copy_advance_check(buf, *scheme);
-    *buf++ = ':';
+    copy_advance_char_check(buf, ':');
 
     /* Print "user:password@", if any. */
@@ -275 +275 @@
         copy_advance_escape(buf, url->user, *spec);
         if (url->passwd.slen) {
-            *buf++ = ':';
+            copy_advance_char_check(buf, ':');
             copy_advance_escape(buf, url->passwd, pc->pjsip_PASSWD_SPEC);
         }
 
-        *buf++ = '@';
+        copy_advance_char_check(buf, '@');
     }
 
@@ -305 +305 @@
             return -1;
 
-        *buf++ = ':';
+        copy_advance_char_check(buf, ':');
         printed = pj_utoa(url->port, buf);
         buf += printed;
@@ -567 +567 @@
     if (context != PJSIP_URI_IN_REQ_URI) {
         if (name->display.slen) {
-            if (endbuf-buf < 8) return -1;
-            *buf++ = '"';
+            if (endbuf-buf < name->display.slen + 3) return -1;
+            copy_advance_char_check(buf, '"');
             copy_advance(buf, name->display);
-            *buf++ = '"';
-            *buf++ = ' ';
+            copy_advance_char_check(buf, '"');
+            copy_advance_char_check(buf, ' ');
         }
-        *buf++ = '<';
+        copy_advance_char_check(buf, '<');;
     }
 
@@ -582 +582 @@
 
     if (context != PJSIP_URI_IN_REQ_URI) {
-        *buf++ = '>';
+        copy_advance_char_check(buf, '>');
     }