Changeset 5753

Timestamp:

Mar 8, 2018 11:54:40 PM (7 years ago)

Author:

ming

Message:

Re #2098: Fixed insufficient buffer length to avoid message truncation.

File:

• pjproject/trunk/pjmedia/src/pjmedia/sdp.c (modified) (1 diff)

pjproject/trunk/pjmedia/src/pjmedia/sdp.c

@@ -549 +549 @@
     attr->name = pj_str("ssrc");
     attr->value.ptr = (char*) pj_pool_alloc(pool, cname->slen+7 /* " cname:"*/
-                                                  + 10 /* 32-bit integer */);
-    attr->value.slen = pj_ansi_snprintf(attr->value.ptr, cname->slen+17,
+                                                  + 10 /* 32-bit integer */
+                                                  + 1 /* NULL */);
+    attr->value.slen = pj_ansi_snprintf(attr->value.ptr, cname->slen+18,
                                         "%d cname:%.*s", ssrc,
                                         (int)cname->slen, cname->ptr);