blob: f38b8a81519676f9b709a03302e8be888ccf0043 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
commit d67b2f9874ca23bd69f18df71b8f53b1b6151f6d
Author: Henning Westerholt <hw@kamailio.org>
Date: Sun Jun 3 20:59:32 2018 +0200
core: improve header safe guards for Via handling
(cherry picked from commit ad68e402ece8089f133c10de6ce319f9e28c0692)
diff --git a/crc.c b/crc.c
index 462846324..23b2876ec 100644
--- a/crc.c
+++ b/crc.c
@@ -231,6 +231,8 @@ void crcitt_string_array( char *dst, str src[], int size )
ccitt = 0xFFFF;
str_len=CRC16_LEN;
for (i=0; i<size; i++ ) {
+ /* invalid str with positive length and null char pointer */
+ if( unlikely(src[i].s==NULL)) break;
c=src[i].s;
len=src[i].len;
while(len) {
diff --git a/msg_translator.c b/msg_translator.c
index 201e3a5e1..58978f958 100644
--- a/msg_translator.c
+++ b/msg_translator.c
@@ -168,12 +168,17 @@ static int check_via_address(struct ip_addr* ip, str *name,
(name->s[name->len-1]==']')&&
(strncasecmp(name->s+1, s, len)==0))
)
- )
+ ) {
return 0;
- else
-
+ }
+ else {
+ if (unlikely(name->s==NULL)) {
+ LM_CRIT("invalid Via host name\n");
+ return -1;
+ }
if (strncmp(name->s, s, name->len)==0)
return 0;
+ }
}else{
LM_CRIT("could not convert ip address\n");
return -1;
|
