Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix off-by-one access triggered eg by Contact: %
  • Loading branch information
davehorton committed Nov 28, 2022
1 parent 0309d0b commit 22c1bd1
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions libsofia-sip-ua/url/url.c
Expand Up @@ -185,7 +185,7 @@ int url_reserved_p(char const *s)
* The number of characters in corresponding but escaped string.
*
* You can handle a part of URL with reserved characters like this:
* @code
*@code
* if (url_reserved_p(s)) {
* n = malloc(url_esclen(s, NULL) + 1);
* if (n) url_escape(n, s);
Expand Down Expand Up @@ -364,6 +364,7 @@ char *url_canonize2(char *d, char const * const s, size_t n,
continue;
}

if (i >= strlen(s) - 1) return NULL;
h1 = s[i + 1], h2 = s[i + 2];

if (!IS_HEX(h1) || !IS_HEX(h2)) {
Expand Down Expand Up @@ -1088,7 +1089,7 @@ char *copy(char *buf, char *end, char const *src)
* @param buf Buffer for non-constant strings copied from @a src.
* @param bufsize Size of @a buf.
* @param dst Destination URL structure.
* @param src Source URL structure.
*@param src Source URL structure.
*
* @return Number of characters required for
* duplicating the strings in @a str, or -1 if an error
Expand Down Expand Up @@ -1172,7 +1173,7 @@ issize_t url_dup(char *buf, isize_t bufsize, url_t *dst, url_t const *src)
* @param buf Buffer for non-constant strings copied from @a src.
* @param end End of @a buf.
* @param dst Destination URL structure.
* @param src Source URL structure.
*@param src Source URL structure.
*
* @return
* The macro URL_DUP() returns pointer to first unused byte in the
Expand Down

0 comments on commit 22c1bd1

Please sign in to comment.