Changeset 4979 for pjproject/trunk/pjsip/src/pjsip/sip_uri.c

Timestamp:

Feb 10, 2015 3:20:04 AM (9 years ago)

Author:

ming

Message:

Re #1782 (misc): Prevent buffer overrun in pjsip message/uri printing
Thanks to Sagi Iltus for the patch

File:

• pjproject/trunk/pjsip/src/pjsip/sip_uri.c (modified) (6 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_uri.c

@@ -122 +122 @@
 
     do {
-        *buf++ = (char)sep;
+        copy_advance_char_check(buf, (char)sep);
         copy_advance_escape(buf, p->name, (*pname_spec));
         if (p->value.slen) {
-            *buf++ = '=';
+            copy_advance_char_check(buf, '=');
             if (*p->value.ptr == '"')
                 copy_advance(buf, p->value);
@@ -266 +266 @@
     scheme = pjsip_uri_get_scheme(url);
     copy_advance_check(buf, *scheme);
-    *buf++ = ':';
+    copy_advance_char_check(buf, ':');
 
     /* Print "user:password@", if any. */
@@ -275 +275 @@
         copy_advance_escape(buf, url->user, *spec);
         if (url->passwd.slen) {
-            *buf++ = ':';
+            copy_advance_char_check(buf, ':');
             copy_advance_escape(buf, url->passwd, pc->pjsip_PASSWD_SPEC);
         }
 
-        *buf++ = '@';
+        copy_advance_char_check(buf, '@');
     }
 
@@ -305 +305 @@
             return -1;
 
-        *buf++ = ':';
+        copy_advance_char_check(buf, ':');
         printed = pj_utoa(url->port, buf);
         buf += printed;
@@ -567 +567 @@
     if (context != PJSIP_URI_IN_REQ_URI) {
         if (name->display.slen) {
-            if (endbuf-buf < 8) return -1;
-            *buf++ = '"';
+            if (endbuf-buf < name->display.slen + 3) return -1;
+            copy_advance_char_check(buf, '"');
             copy_advance(buf, name->display);
-            *buf++ = '"';
-            *buf++ = ' ';
+            copy_advance_char_check(buf, '"');
+            copy_advance_char_check(buf, ' ');
         }
-        *buf++ = '<';
+        copy_advance_char_check(buf, '<');;
     }
 
@@ -582 +582 @@
 
     if (context != PJSIP_URI_IN_REQ_URI) {
-        *buf++ = '>';
+        copy_advance_char_check(buf, '>');
     }