chan_sip: Fix buffer overrun in sip_sipredirect.
authorCorey Farrell <git@cfware.com>
Mon, 25 Jan 2016 17:03:21 +0000 (12:03 -0500)
committerCorey Farrell <git@cfware.com>
Mon, 25 Jan 2016 17:13:11 +0000 (11:13 -0600)
sip_sipredirect uses sscanf to copy up to 256 characters to a stacked buffer
of 256 characters.  This patch reduces the copy to 255 characters to leave
room for the string null terminator.

ASTERISK-25722 #close

Change-Id: Id6c3a629a609e94153287512c59aa1923e8a03ab

channels/chan_sip.c

index 9e87027..a3c6fb2 100644 (file)
@@ -33012,8 +33012,8 @@ static int sip_sipredirect(struct sip_pvt *p, const char *dest)
 
                        memset(ldomain, 0, sizeof(ldomain));
                        local_to_header++;
-                       /* This is okey because lhost and lport are as big as tmp */
-                       sscanf(local_to_header, "%256[^<>; ]", ldomain);
+                       /* Will copy no more than 255 chars plus null terminator. */
+                       sscanf(local_to_header, "%255[^<>; ]", ldomain);
                        if (ast_strlen_zero(ldomain)) {
                                ast_log(LOG_ERROR, "Can't find the host address\n");
                                return 0;