rr: bound maddr URI construction

Reported-by: Haruto Kimura (Stella)
(cherry picked from commit 02ca6f06492fa92d5ae7583908e84b682a0c34a3)

Author: razvancrainea

modules/rr/loose.c

@@ -358,6 +358,7 @@ static inline int get_maddr_uri(str *uri, struct sip_uri *puri)
 {
 	static char builturi[RH_MADDR_PARAM_MAX_LEN+1];
 	struct sip_uri turi;
+	int len;
 
 	if(uri==NULL || uri->s==NULL)
 		return RR_ERROR;
@@ -380,6 +381,12 @@ static inline int get_maddr_uri(str *uri, struct sip_uri *puri)
 		LM_ERR( "Too long maddr parameter\n");
 		return RR_ERROR;
 	}
+	len = 4 + puri->maddr_val.len
+					+ ((puri->port.len>0)?(1+puri->port.len):0);
+	if( len > RH_MADDR_PARAM_MAX_LEN ) {
+		LM_ERR( "Too long maddr URI\n");
+		return RR_ERROR;
+	}
 	memcpy( builturi, "sip:", 4 );
 	memcpy( builturi+4, puri->maddr_val.s, puri->maddr_val.len );
 
@@ -390,8 +397,7 @@ static inline int get_maddr_uri(str *uri, struct sip_uri *puri)
 				puri->port.len);
 	}
 
-	uri->len = 4+puri->maddr_val.len
-					+ ((puri->port.len>0)?(1+puri->port.len):0);
+	uri->len = len;
 	builturi[uri->len]='\0';
 	uri->s = builturi;