[Asterisk-cvs] asterisk/channels chan_sip.c,1.267,1.268

[Chris Wilson]

Hi Jeremy,

> Update of /usr/cvsroot/asterisk/channels
> In directory mongoose.digium.com:/tmp/cvs-serv14641
> 
> Modified Files:
> 	chan_sip.c 
> Log Message:
> check buffer for possible overflow. Thanks Corydon76 Bug #788
[...]
>  		y = 0;
>  	for (x=0;x<req->lines;x++) {
>  		strncat(buf, req->line[x], y);
> -		strcat(buf, "\n");
> +		y -= strlen(req->line[x]) + 1;
> +		if (y < 0)
> +			y = 0;
> +		if (y != 0)
> +			strcat(buf, "\n");

I think you need to subtract 1 more from y as well, when you append "\n" 
to buf.

Cheers, Chris.
-- 
_  __ __     _
 / __/ / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_  ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\__/_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |