mirror of
https://github.com/signalwire/freeswitch.git
synced 2026-10-04 02:03:59 +00:00
`read_packet()` passed a peer-supplied `Content-Length` straight to `switch_zmalloc(body, clen + 1)`. Huge values drove `calloc` failure and `switch_zmalloc` `abort()`-ed the daemon. - Cap `Content-Length` at 16 MiB; reject negatives. - Destroy the partially-built `*event` at the new rejection site and at the existing body-recv failure path so callers don't leak it. - Add `test_mod_event_socket` covering `INT_MAX`, above-cap, negative, `atoi`-overflow, zero, and valid-non-zero-body cases.