ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-08-19 09:40:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
`sofia_dialog_probe_callback()` filled its fixed 512-byte
`remote_display_buf` with unbounded `strcpy`. On the default path the
source is the stored To-header user part, which `sip_dialogs.sip_to_user`
holds verbatim from the wire with no truncation, so a dialog row
addressed to a user part longer than 511 bytes overflowed the buffer
when a `dialog`-package SUBSCRIBE ran the probe.

Copy with `snprintf()` bounded by `sizeof(remote_display_buf)` on every
path that writes it. The four proto branches write short fixed strings
and could not overflow; they are converted for consistency. User parts
under 512 bytes are copied unchanged.
This commit is contained in:
Dmitry Verenitsin
2026-08-08 20:31:33 +03:00
committed by GitHub
parent 432349278c
commit 49f39c074a
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mod/endpoints/mod_sofia/sofia_presence.c
+5 -5
View File
@@ -2017,7 +2017,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
buf_to_free = switch_mprintf("sip:queue+%s", to_user);
}
remote_uri = buf_to_free;
strcpy(remote_display_buf, "queue");
snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "queue");
remote_user = to_user;
remote_host = local_host;
}
@@ -2031,7 +2031,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
buf_to_free = switch_mprintf("sip:park+%s", to_user);
}
remote_uri = buf_to_free;
strcpy(remote_display_buf, "park");
snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "park");
remote_user = to_user;
remote_host = local_host;
}
@@ -2045,7 +2045,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
buf_to_free = switch_mprintf("sip:pickup+%s", to_user);
}
remote_uri = buf_to_free;
strcpy(remote_display_buf, "pickup");
snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "pickup");
remote_user = to_user;
remote_host = local_host;
}
@@ -2058,7 +2058,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
buf_to_free = switch_mprintf("sip:conf+%s@%s", to_user, host);
}
remote_uri = buf_to_free;
strcpy(remote_display_buf, "conference");
snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", "conference");
remote_user = to_user;
remote_host = local_host;
}
@@ -2073,7 +2073,7 @@ static int sofia_dialog_probe_callback(void *pArg, int argc, char **argv, char *
local_user = from_user;
buf_to_free = switch_mprintf("**%s@%s", from_user, local_host);
remote_uri = buf_to_free;
strcpy(remote_display_buf, to_user);
snprintf(remote_display_buf, sizeof(remote_display_buf), "%s", to_user);
remote_user = to_user;
remote_host = local_host;
}