sdpops: safety check when location a= line not to exceed end of message

(cherry picked from commit 9159695)
kamailio · Feb 23, 2015 · e24c9ff · e24c9ff
1 parent 449ba0c
commit e24c9ff
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/modules/sdpops/sdpops_mod.c b/modules/sdpops/sdpops_mod.c
@@ -156,12 +156,17 @@ static int mod_init(void)
 int sdp_locate_line(sip_msg_t* msg, char *pos, str *aline)
 {
 	char *p;
+	char *bend;
+
 	p = pos;
 	while(*p!='\n') p--;
 	aline->s = p + 1;
 	p = pos;
-	while(*p!='\n') p++;
+	bend = msg->buf+msg->len;
+	while(*p!='\n' && p<bend) p++;
 	aline->len = p - aline->s + 1;
+	if(unlikely(p==bend)) aline->len--;
+
 	return 0;
 }