Skip to content

Commit

Permalink
utils: Fix buffer overflow; do not NULL-terminate HTTP result
Browse files Browse the repository at this point in the history
Fix buffer overflow in the `write_function` that takes the resulting
data from libcurl. The function was trying to NULL terminate the
string, but this could result in overwriting the buffer by one byte
when size*nmemb == 1.
This also caused some memory corruptions, reported on sr-dev.

Reported by: Travis Cross <tc@traviscross.com>
  • Loading branch information
carstenbock committed Aug 28, 2015
1 parent eb4644d commit 2ebcb84
Showing 1 changed file with 3 additions and 6 deletions.
9 changes: 3 additions & 6 deletions modules/utils/functions.c
Expand Up @@ -2,7 +2,7 @@
* script functions of utils module
*
* Copyright (C) 2008 Juha Heinanen
* Copyright (C) 2013 Carsten Bock, ng-voice GmbH
* Copyright (C) 2013-2015 Carsten Bock, ng-voice GmbH
*
* This file is part of Kamailio, a free SIP server.
*
Expand Down Expand Up @@ -55,7 +55,7 @@ size_t write_function( void *ptr, size_t size, size_t nmemb, void *stream_ptr)
http_res_stream_t *stream = (http_res_stream_t *) stream_ptr;

stream->buf = (char *) pkg_realloc(stream->buf, stream->curr_size +
(size * nmemb) + 1);
(size * nmemb));

if (stream->buf == NULL) {
LM_ERR("cannot allocate memory for stream\n");
Expand All @@ -64,15 +64,12 @@ size_t write_function( void *ptr, size_t size, size_t nmemb, void *stream_ptr)

memcpy(&stream->buf[stream->pos], (char *) ptr, (size * nmemb));

stream->curr_size += ((size * nmemb) + 1);
stream->curr_size += (size * nmemb);
stream->pos += (size * nmemb);

stream->buf[stream->pos + 1] = '\0';

return size * nmemb;
}


/*
* Performs http_query and saves possible result (first body line of reply)
* to pvar.
Expand Down

0 comments on commit 2ebcb84

Please sign in to comment.