From b8458c65917c1b1fe9b94bae795dcdb75ecf4f07 Mon Sep 17 00:00:00 2001
From: Carsten Bock <carsten@ng-voice.com>
Date: Tue, 3 Nov 2015 17:34:18 +0100
Subject: [PATCH] ims_registrar_scscf: Safety check the length of the
 destination string

---
 modules/ims_registrar_scscf/registrar_notify.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/ims_registrar_scscf/registrar_notify.c b/modules/ims_registrar_scscf/registrar_notify.c
index c0e6aece961..77abf905383 100644
--- a/modules/ims_registrar_scscf/registrar_notify.c
+++ b/modules/ims_registrar_scscf/registrar_notify.c
@@ -2024,10 +2024,8 @@ reg_notification * new_notification(str subscription_state,
         return 0;
     }
 
-    sprintf(bufc, content.s, r->version);
     buf.s = bufc;
-    buf.len = strlen(bufc);
-
+    buf.len = snprintf(buf.s, MAX_REGINFO_SIZE, content.s, r->version);
 
     int len;
     char *p;