[Asterisk-code-review] pjsip: prevent memory corruption on creation of xml bodies (asterisk[13])

[Anonymous Coward]

Anonymous Coward #1000019 has submitted this change and it was merged. ( https://gerrit.asterisk.org/5171 )

Change subject: pjsip: prevent memory corruption on creation of xml bodies
......................................................................


pjsip: prevent memory corruption on creation of xml bodies

ASTERISK-26776 #close

Change-Id: I884b6f4e8233a355d0be687ec78d41bc0e4d3fd2
---
A third-party/pjproject/patches/0025-fix-print-xml-crash.patch
1 file changed, 24 insertions(+), 0 deletions(-)

Approvals:
  Anonymous Coward #1000019: Verified
  Sean Bright: Looks good to me, but someone else must approve
  Joshua Colp: Looks good to me, approved



diff --git a/third-party/pjproject/patches/0025-fix-print-xml-crash.patch b/third-party/pjproject/patches/0025-fix-print-xml-crash.patch
new file mode 100644
index 0000000..eafc389
--- /dev/null
+++ b/third-party/pjproject/patches/0025-fix-print-xml-crash.patch
@@ -0,0 +1,24 @@
+From 1bc5ca699f523bd8e910203a3eb4dee58f366976 Mon Sep 17 00:00:00 2001
+From: Joshua Elson <joshelson at gmail.com>
+Date: Mon, 20 Mar 2017 19:28:47 -0600
+Subject: [PATCH] Prevent memory corruption on xml tag write
+
+---
+ pjlib-util/src/pjlib-util/xml.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/pjlib-util/src/pjlib-util/xml.c b/pjlib-util/src/pjlib-util/xml.c
+index 296b232..b0aad26 100644
+--- a/pjlib-util/src/pjlib-util/xml.c
++++ b/pjlib-util/src/pjlib-util/xml.c
+@@ -248,6 +248,7 @@ static int xml_print_node( const pj_xml_node *node, int indent,
+     if (node->content.slen==0 &&
+ 	node->node_head.next==(pj_xml_node*)&node->node_head)
+     {
++	if (SIZE_LEFT() < 3) return -1;
+ 	*p++ = ' ';
+ 	*p++ = '/';
+ 	*p++ = '>';
+-- 
+2.10.1 (Apple Git-78)
+

-- 
To view, visit https://gerrit.asterisk.org/5171
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I884b6f4e8233a355d0be687ec78d41bc0e4d3fd2
Gerrit-PatchSet: 3
Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Owner: Joshua Elson <joshelson at gmail.com>
Gerrit-Reviewer: Anonymous Coward #1000019
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-Reviewer: Matthew Fredrickson <creslin at digium.com>
Gerrit-Reviewer: Richard Mudgett <rmudgett at digium.com>
Gerrit-Reviewer: Sean Bright <sean.bright at gmail.com>