http_client: safety check for lenght of retrieved headers

kamailio · Jul 27, 2017 · eb6c946 · eb6c946
1 parent 00f2cfd
commit eb6c946
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/src/modules/http_client/functions.c b/src/modules/http_client/functions.c
@@ -333,23 +333,25 @@ static int curL_query_url(struct sip_msg* _m, const char* _url, str* _dst,
 	/* HTTP_CODE CHANGED TO CURLINFO_RESPONSE_CODE in curl > 7.10.7 */
 	curl_easy_getinfo(curl, CURLINFO_HTTP_CODE, &stat);
 	if(res == CURLE_OK) {
-		char *ct;
-		char *url;
+		char *ct = NULL;
+		char *url = NULL;
 
 		/* ask for the content-type of the response */
 		res = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct);
 		res |= curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &url);
 
 		if(ct) {
 			LM_DBG("We received Content-Type: %s\n", ct);
-			if (params->pconn) {
+			if (params->pconn &&
+					strlen(ct)<sizeof(params->pconn->result_content_type)-1) {
 				strncpy(params->pconn->result_content_type, ct,
 						sizeof(params->pconn->result_content_type));
 			}
 		}
 		if(url) {
 			LM_DBG("We visited URL: %s\n", url);
-			if (params->pconn) {
+			if (params->pconn
+					&& strlen(url)<sizeof(params->pconn->redirecturl)-1) {
 				strncpy(params->pconn->redirecturl, url ,
 						sizeof(params->pconn->redirecturl));
 			}