Skip to content

Commit

Permalink
core: fixed segmentation fault when handling multipart bodies
Browse files Browse the repository at this point in the history
Function check_boundaries() in msg_translator.c not handling property the length of the buffers when it needs to repair the boundary, getting a negative lenght and causing a segmentation fault.
  • Loading branch information
NGSegovia authored and linuxmaniac committed Dec 7, 2018
1 parent 1285f78 commit 18e485a
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/core/msg_translator.c
Expand Up @@ -1838,10 +1838,10 @@ int check_boundaries(struct sip_msg *msg, struct dest_info *send_info)
tmp.len = get_line(lb_t->s);
if(tmp.len!=b.len || strncmp(b.s, tmp.s, b.len)!=0)
{
LM_DBG("malformed bondary in the middle\n");
LM_DBG("malformed boundary in the middle\n");
memcpy(pb, b.s, b.len); body.len = body.len + b.len;
pb = pb + b.len;
t = lb_t->s.s - (lb_t->s.s + tmp.len);
t = lb_t->next->s.s - (lb_t->s.s + tmp.len);
memcpy(pb, lb_t->s.s+tmp.len, t); pb = pb + t;
/*LM_DBG("new chunk[%d][%.*s]\n", t, t, pb-t);*/
}
Expand Down

0 comments on commit 18e485a

Please sign in to comment.