ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-08-19 09:40:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
`get_display_name_from_contact()` copied the SIP Contact display-name
into the caller's fixed 512-byte `remote_display_buf` with an unbounded
`strcpy`, so a stored dialog row with an over-long Contact could
overflow the stack buffer when a `dialog`-package SUBSCRIBE runs the
probe.

Thread the destination size into the helper and copy with
`switch_copy_string()`. Guard the helper against a zero
`dst_size` and a `NULL` or empty input, and always null-terminate the
destination.
This commit is contained in:
Dmitry Verenitsin
2026-08-08 20:06:17 +03:00
committed by GitHub
parent 2ab0a534fd
commit 21d8a78fbc
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mod/endpoints/mod_sofia/sofia_presence.c
+11 -6
View File
@@ -1896,7 +1896,7 @@ static int sofia_presence_resub_callback(void *pArg, int argc, char **argv, char
return 0;
}
char *get_display_name_from_contact(const char *in, char* dst)
char *get_display_name_from_contact(const char *in, char* dst, size_t dst_size)
{
// name-addr = [ display-name ] LAQUOT addr-spec RAQUOT
// display-name = *(token LWS)/ quoted-string
@@ -1904,8 +1904,13 @@ char *get_display_name_from_contact(const char *in, char* dst)
char *p;
char *buf;
strcpy(dst, "");
if (strchr(in, '<') && strchr(in, '>')) {
if (!dst || !dst_size) {
return dst;
}
*dst = '\0';
if (!zstr(in) && strchr(in, '<') && strchr(in, '>')) {
buf = strdup(in);
switch_assert(buf);
p = strchr(buf, '<');
@@ -1918,11 +1923,11 @@ char *get_display_name_from_contact(const char *in, char* dst)
char *q = strdup(p + 1);
switch_assert(q);
end_of(q) = '\0';
strcpy(dst, q);
switch_copy_string(dst, q, dst_size);
switch_safe_free(q);
}
} else {
strcpy(dst, p);
switch_copy_string(dst, p, dst_size);
}
switch_safe_free(p);
}
@@ -2059,7 +2064,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
}
else if (bInternal) {
local_user = to_user;
get_display_name_from_contact(contact, remote_display_buf);
get_display_name_from_contact(contact, remote_display_buf, sizeof(remote_display_buf));
buf_to_free = sofia_glue_strip_uri(contact);
remote_uri = buf_to_free;
remote_user = contact_user;